CVE-2026-55517: Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.5, a Deno program that opens a client WebSocket connection could be crashed by the…

PriorityP421medium4.3CVSS 3.1

AVNACLPRNUIRSUCNINAL

EPSS

0.32%

24.6th percentile

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.5, a Deno program that opens a client WebSocket connection could be crashed by the remote server. While handling the WebSocket handshake response, Deno parsed the Sec-WebSocket-Protocol and Sec-WebSocket-Extensions response headers in a way that assumed their bytes were always printable ASCII. A response header containing non-visible-ASCII bytes (0x80-0xFF) caused a panic that aborted the entire Deno process. This vulnerability is fixed in 2.7.5.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
deno	deno	< 2.7.5	2.7.5
deno	deno	>= 0 < 2.7.5	2.7.5
denoland	deno	< 2.7.5	2.7.5

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.