Deno is a JavaScript

Deno's runtime permission model lets operators run untrusted JavaScript/TypeScript with --deny-net=10.0.0.0/8,169.254.169.254,... to keep scripts off internal networks and cloud metadata endpoints. CVE-2026-49860 is a classic *time-of-check / time-of-use* gap in the WebSocket API: Deno validates the hostname string against the deny list, then performs DNS resolution and connects to whatever IP comes back. An attacker hosting a domain that resolves to 169.254.169.254 (or 127.0.0.1, or an RFC1918 address) passes the string check, then connects to the forbidden IP. All Deno versions before 2.8.1 are affected; fixed in 2.8.1.

Vendor pegged this at MEDIUM 5.2 (AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) — that's appropriate. The vector correctly captures that the attacker must already be executing code inside the Deno sandbox; the bug only *defeats a defense-in-depth control*, it does not grant RCE, code execution, or remote reachability on its own. The Scope:Changed flag is what bumps it out of LOW territory in CVSS math — escaping the permission boundary touches a different trust zone. In practice, the population of orgs running untrusted Deno scripts behind --deny-net is a small subset of Deno's already modest enterprise footprint, and most of them are pairing it with network egress filtering anyway. We're calling this LOW.

Why this verdict

• Preconditions are heavy. Attacker must (a) get code into a Deno runtime, (b) that runtime must use --deny-net, and (c) the targeted internal service must speak WebSocket. Each prerequisite narrows the population.
• No remote reachability. AV:L is correct — the bug is unreachable from the network without an existing code-execution channel. EPSS 0.00106 reflects this.
• Blast radius is sandbox-escape only. Successful exploitation reveals the internal-IP attack surface to an already-running attacker script; it does not create one.
• Role multiplier: low-value role (typical). Deno runs scripts, CLI tools, build steps, edge functions. Even in the most common configuration the chain ends at *one reachable internal HTTP/WS endpoint per request*, not fleet compromise.
• Role multiplier: typical role. Deno used as a serverless/edge function platform — chain still ends at SSRF against whatever the worker pod can reach; cloud metadata (the canonical SSRF prize) is HTTP-only and IMDSv2 defeats it.
• Role multiplier: high-value role. Deno is not deployed as a domain controller, IdP, hypervisor, PAM, CA, backup server, EDR/AV, or network-edge appliance. There is no canonical high-value role for the Deno binary, so the deployment-role floor does not push above HIGH and is not engaged here.
• No KEV, no active exploitation, no public PoC repo. Removes the override that would force immediate mitigation regardless of bucket.

Why not higher?

Promoting to MEDIUM would require either a credible path to remote unauthenticated reach (there is none — AV:L), a high-value-role component (Deno is not), or KEV/active-exploitation evidence (none). The CVSS 5.2 MEDIUM rating is driven almost entirely by Scope:Changed; in operator reality, sandbox-bypass-only with no chained impact does not warrant a 30-day mitigation SLA.

Why not lower?

Calling this IGNORE would be wrong because the bug is a real, exploitable control bypass with a published fix and a non-zero population of multi-tenant Deno operators (Deno Deploy, edge-worker shops) for whom --deny-net is a load-bearing boundary. LOW correctly flags it as backlog hygiene without forcing emergency change-windows.

1. Upgrade Deno to 2.8.1+ — The only complete fix. Deno is a single static binary; replace it in your container images, GitHub Actions runners, and edge-worker bases. No mitigation SLA applies (LOW verdict per noisgate SLA); fold into the standard 365-day remediation track and roll it during the next normal base-image refresh.
2. Block egress to RFC1918, link-local (169.254/16), and loopback at the network layer for Deno workloads — A network-layer egress policy on the host/pod (NetworkPolicy, iptables, security group, service-mesh egress rules) makes the post-DNS bypass moot because the *socket* never establishes. This is the right control for multi-tenant Deno operators and should be in place regardless of this CVE. Apply during the same 365-day window.
3. Enforce IMDSv2 on all AWS instances running Deno workloads — Even if WS-over-SSRF reaches 169.254.169.254, IMDSv2 requires a session token obtained via PUT — which a one-shot SSRF cannot mint. This is general SSRF hardening, not CVE-specific.
4. Inventory where Deno actually runs --deny-net — Most Deno installs in your fleet are probably trusted first-party scripts running with broad permissions; for those the CVE is informational. Confirm where the deny list is load-bearing and prioritize those hosts within the LOW remediation window.

Run on each Linux/macOS host or container image that ships a Deno binary. Invoke as bash check-cve-2026-49860.sh (no privileges required — it just inspects the on-disk Deno version). Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN.

#!/usr/bin/env bash
# check-cve-2026-49860.sh — Deno WebSocket post-DNS check bypass
# PATCHED: Deno >= 2.8.1
set -u

FIXED_MAJOR=2
FIXED_MINOR=8
FIXED_PATCH=1

DENO_BIN="${DENO_BIN:-$(command -v deno || true)}"
if [ -z "$DENO_BIN" ] || [ ! -x "$DENO_BIN" ]; then
  echo "UNKNOWN: deno not found on PATH (set DENO_BIN=/path/to/deno to override)"
  exit 2
fi

RAW="$("$DENO_BIN" --version 2>/dev/null | head -n1)"
# Expected: 'deno 2.8.1 (release, x86_64-unknown-linux-gnu)'
VER="$(printf '%s' "$RAW" | awk '{print $2}')"
if [ -z "$VER" ]; then
  echo "UNKNOWN: could not parse 'deno --version' output: $RAW"
  exit 2
fi

IFS='.' read -r MAJ MIN PAT <<<"$VER"
MAJ="${MAJ:-0}"; MIN="${MIN:-0}"; PAT="${PAT%%-*}"; PAT="${PAT:-0}"

cmp() {
  if   [ "$MAJ" -gt "$FIXED_MAJOR" ]; then return 0
  elif [ "$MAJ" -lt "$FIXED_MAJOR" ]; then return 1
  elif [ "$MIN" -gt "$FIXED_MINOR" ]; then return 0
  elif [ "$MIN" -lt "$FIXED_MINOR" ]; then return 1
  elif [ "$PAT" -ge "$FIXED_PATCH" ]; then return 0
  else return 1
  fi
}

if cmp; then
  echo "PATCHED: deno $VER (>= 2.8.1) at $DENO_BIN"
  exit 0
else
  echo "VULNERABLE: deno $VER (< 2.8.1) at $DENO_BIN — upgrade to 2.8.1+"
  exit 1
fi

Sources

1. GitLab Advisories — CVE-2026-49860
2. GitHub Security Advisory GHSA-83pc-3rw9-qpwj
3. Deno release notes
4. Deno permissions documentation (--deny-net)
5. CWE-918: Server-Side Request Forgery
6. FIRST EPSS model
7. CISA KEV catalog
8. AWS IMDSv2 (mitigates SSRF→metadata)