CVE-2026-55517: Deno

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.5, a Deno program that opens a client WebSocket connection could be crashed by the remote server. While handling the WebSocket handshake response, Deno parsed the Sec-WebSocket-Protocol and Sec-WebSocket-Extensions response headers in a way that assumed their bytes were always printable ASCII. A response header containing non-visible-ASCII bytes (0x80-0xFF) caused a panic that aborted the entire Deno process. This vulnerability is fixed in 2.7.5.

Affected products

• Deno Deno: before 2.7.5 (fixed in 2.7.5)

Published 2026-06-23. Last modified 2026-06-29.