CVE-2026-55517 Deno: Denial of service via non-ASCII bytes in WebSocket response headers

What is CVE-2026-55517?

CVE-2026-55517 is a medium-severity denial of service vulnerability in denoland deno, published on 23 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.5, a Deno program that opens a client WebSocket connection could be crashed by the remote server. While handling the WebSocket handshake response, Deno parsed the Sec-WebSocket-Protocol and Sec-WebSocket-Extensions response headers in a way that assumed their bytes were always printable ASCII. A response header containing non-visible-ASCII bytes (0x80-0xFF) caused a panic that aborted the entire Deno process. This vulnerability is fixed in 2.7.5.

Weakness: CWE-248

Which versions are affected by CVE-2026-55517?

2 open source packages ship an affected version, including deno. It affects 1 product.

Products include Deno Deno.

How do I fix CVE-2026-55517?

Upgrade deno to 2.7.5 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-55517 being exploited?

There is no known exploitation of CVE-2026-55517 in the wild and no public exploit code.

Other vulnerabilities in denoland deno

• CVE-2023-28445 Deno improperly handles resizable ArrayBuffer Critical 10.0
• CVE-2022-24783 Sandbox bypass leading to arbitrary code execution in Deno Critical 10.0
• CVE-2021-32619 Static imports inside dynamically imported modules do not adhere to permission checks Critical 9.8
• CVE-2026-22863 Deno node:crypto doesn't finalize cipher Critical 9.2
• CVE-2024-27936 Deno interactive permission prompt spoofing via improper ANSI stripping High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-x2qc-cmh9-f4hf, JLSEC-2026-1167.