6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-49411

CVE-2026-49411: Deno Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.0, the Node.js compatibility TCP path checked the permission against the original hostname string before resolution and then did not re-check after resolution. A caller could therefore pass a numeric alias of an IP address (for example the decimal integer 2130706433 or the hex form 0x7f000001, both of which resolve to 127.0.0.1) and reach the denied destination through node:net.connect or node:http.request's { host, port } options form. This vulnerability is fixed in 2.8.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-49411

CVE-2026-49411:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
deno	rust	<= 2.7.14	2.8.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in Deno's Node.js compatibility layer, specifically in how it handled network permissions for TCP connections. The --deny-net flag was being checked against the hostname string provided by the user, but not against the final, resolved IP address. This created a loophole where an attacker could use numeric aliases of an IP address (e.g., the decimal or hexadecimal representation of 127.0.0.1) to connect to a destination that was explicitly denied.\n\nThe analysis of the patch between the vulnerable version (2.7.14) and the patched version (2.8.0) pointed to a single commit e40b1b1dc646dcf9f4f7e0fc89e8211751252540. This commit modifies ext/node/ops/tcp_wrap.rs, which contains the native Rust implementation for the node:net module.\n\nThe patch introduces a call to check_net_resolved() within the TCPWrap::connect and TCPWrap::connect6 functions. This new check is performed after the hostname has been resolved to an IP address, ensuring that the deny-list rules are applied to the actual destination IP. The vulnerable functions are therefore TCPWrap::connect and TCPWrap::connect6 because they were the ones lacking this crucial post-resolution check, allowing the bypass. During exploitation, a call to node:net.connect or node:http.request with a numeric hostname alias would trigger these functions, and they would appear in a runtime profile.

Vulnerable functions

TCPWrap::connect

ext/node/ops/tcp_wrap.rs

This function, which handles TCP connections for the Node.js compatibility layer, was missing a permission check on the resolved IP address. It only checked against the user-provided hostname. This allowed an attacker to bypass `--deny-net` rules by providing a numeric alias (decimal or hex) for a denied IP address. The patch adds the `check_net_resolved` call after hostname resolution to fix this.

TCPWrap::connect6

ext/node/ops/tcp_wrap.rs

Similar to `TCPWrap::connect`, this function for handling IPv6 TCP connections was also missing a permission check on the resolved IP address. This allowed bypassing `--deny-net` rules. The patch adds the `check_net_resolved` call to enforce the deny rules on the final IP address.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.