CVE-2024-27932 Deno's improper suffix match testing for DENO_AUTH_TOKENS

What is CVE-2024-27932?

CVE-2024-27932 is a medium-severity vulnerability in denoland deno, published on 6 Mar 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.8.0 and prior to version 1.40.4, Deno improperly checks that an import specifier's hostname is equal to or a child of a token's hostname, which can cause tokens to be sent to servers they shouldn't be sent to. An auth token intended for `example[.]com` may be sent to `notexample[.]com`. Anyone who uses DENO_AUTH_TOKENS and imports potentially untrusted code is affected. Version 1.40.0 contains a patch for this issue

Weakness: CWE-20

Which versions are affected by CVE-2024-27932?

2 open source packages ship an affected version, including deno. It affects 1 product.

Products include Deno Deno.

How do I fix CVE-2024-27932?

Upgrade deno to 1.40.4 or later.

Is CVE-2024-27932 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-27932 exists.

Other vulnerabilities in denoland deno

• CVE-2023-28445 Deno improperly handles resizable ArrayBuffer Critical 10.0
• CVE-2022-24783 Sandbox bypass leading to arbitrary code execution in Deno Critical 10.0
• CVE-2021-32619 Static imports inside dynamically imported modules do not adhere to permission checks Critical 9.8
• CVE-2026-22863 Deno node:crypto doesn't finalize cipher Critical 9.2
• CVE-2024-27936 Deno interactive permission prompt spoofing via improper ANSI stripping High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5frw-4rwq-xhcr, JLSEC-2026-104.