https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T00:18:27.511717+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-330760 EUVD-2026-330760 2026-10-07T00:18:27.560956+00:00 EUVD-2026-330760 https://cve.radiocsirt.org/vuln/fkie_cve-2026-49411 fkie_cve-2026-49411 2026-10-07T00:18:27.560993+00:00

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.0, the Node.js compatibility TCP path checked the permission against the original hostname string before resolution and then did not re-check after resolution. A caller could therefore pass a numeric alias of an IP address (for example the decimal integer 2130706433 or the hex form 0x7f000001, both of which resolve to 127.0.0.1) and reach the denied destination through node:net.connect or node:http.request's { host, port } options form. This vulnerability is fixed in 2.8.0.

 https://cve.radiocsirt.org/vuln/ghsa-v8fw-85r8-5m23 GHSA-v8fw-85r8-5m23 — Deno: Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks 2026-10-07T00:18:27.561030+00:00

Affected: crates.io: deno

## Summary

Deno's network permission model is designed so that `--deny-net` rules apply to the **resolved IP address** of a destination, not just the literal string supplied by the caller. That means `--deny-net=127.0.0.1` (or `--deny-net=127.0.0.0/8`) is expected to block any attempt to reach loopback, regardless of how the hostname is spelled.

On affected versions, the Node.js compatibility TCP path checked the permission against the **original hostname string** before resolution and then did not re-check after resolution. A caller could therefore pass a numeric alias of an IP address (for example the decimal integer `2130706433` or the hex form `0x7f000001`, both of which resolve to `127.0.0.1`) and reach the denied destination through `node:net.connect` or `node:http.request`'s `{ host, port }` options form.

The native `Deno.connect()`, `fetch()`, and URL-string variants of `node:http.request("http://...")` were not affected, because they either re-checked permissions after resolution or normalized the hostname through the URL parser before checking.

## Proof of concept

Run on Deno `2.7.14`, with a local TCP listener on `127.0.0.1:<PORT>`:

```js import net from "node:net";

// --allow-net + --deny-net=127.0.0.0/8 // (or even --deny-net=127.0.0.1:<PORT>) net.connect({ host: "2130706433", port: PORT }); // CONNECTED ❌ net.connect({ host: "0x7f000001", port: PORT }); // CONNECTED ❌ net.connect({ host: "127.0.0.1", port: PORT }); // denied ✅ ```

The same…