5.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-49859

CVE-2026-49859: Deno: `fetch()` API sandbox bypass via missing DNS resolution check

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when fetch() was called, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name that passes the hostname check yet resolves to a denied IP, bypassing the network restriction entirely. This vulnerability is fixed in 2.8.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-49859

CVE-2026-49859:

5.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
deno	rust	<= 2.8.0	2.8.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a sandbox bypass in Deno's fetch() and WebSocket APIs, caused by a Time-of-check/Time-of-use (TOCTOU) flaw. Deno correctly checked if a given hostname was allowed by the --deny-net rules. However, it did not perform any checks on the IP addresses that the hostname resolved to. An attacker could exploit this by using a specially crafted domain name that passes the initial hostname check but resolves to a denied IP address (e.g., localhost or an internal service IP).

The analysis of the patch commit 3d6c61477c78456b408c68ad8454dfa393232adc reveals the root cause and the fix. The core of the vulnerability was in the DNS resolver, specifically deno_fetch::dns::Resolver::call, which performed DNS lookups without validating the resulting IP addresses against the permission set.

The fix involved several changes:

A new function, check_resolved_permissions, was introduced in ext/fetch/dns.rs to perform the post-resolution IP check.
The deno_fetch::dns::Resolver::call method was updated to use this new function after a successful DNS lookup.
The PermissionsContainer is now threaded through the client creation process, starting from op_fetch_custom_client and op_ws_create, down to the DNS resolver, ensuring it has the context to perform the checks.
A new PermissionedHttpConnector was introduced to solve a problem where the DNS resolver didn't know the destination port, making port-specific deny rules ineffective. This connector uses a tokio::task_local to pass the port from the URI down to the resolver.

By identifying the functions that were modified to thread permissions and perform these new checks, we can pinpoint the functions that were part of the vulnerable execution path. These include the functions responsible for creating the HTTP and WebSocket clients (create_client_from_options, create_client_from_websocket_options) and the DNS resolver itself.

Vulnerable functions

deno_fetch::dns::Resolver::call

ext/fetch/dns.rs

The `call` method in `deno_fetch::dns::Resolver` is responsible for DNS resolution. Before the patch, it resolved the hostname to IP addresses and returned them without checking them against the `--deny-net` list. This created a Time-of-check/Time-of-use (TOCTOU) vulnerability where a hostname could pass the initial check, but then resolve to a denied IP address, bypassing the network sandbox. The patch adds a call to `check_resolved_permissions` to verify the resolved IP addresses against the deny list.

deno_fetch::create_client_from_options

ext/fetch/lib.rs

This function was responsible for creating an HTTP client for `fetch()`. It was vulnerable because it configured the client's DNS resolver without attaching the `PermissionsContainer`. This meant the resolver would not have the context to check resolved IP addresses against the `--deny-net` rules. The patch modifies the function to accept a `PermissionsContainer` and uses it to create a permission-aware DNS resolver.

deno_websocket::create_client_from_websocket_options

ext/websocket/lib.rs

Similar to the `fetch` API, this function created a client for WebSocket connections. It was vulnerable because it configured the client's DNS resolver without passing the necessary `PermissionsContainer`, thus disabling the post-resolution IP address check against the `--deny-net` list. The patch adds the `permissions` parameter and uses it to create a secure DNS resolver.

deno_fetch::create_http_client

ext/fetch/lib.rs

This function constructs the underlying HTTP client. A key part of the vulnerability was that the DNS resolver did not know the destination port during the check. The vulnerable version of this function created a standard `HttpConnector`. The patch wraps the connector in a new `dns::PermissionedHttpConnector`, which ensures the destination port is available to the DNS resolver, allowing for a correct and complete permission check.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.