4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-55517

CVE-2026-55517: Deno: Denial of service via non-ASCII bytes in WebSocket response headers

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.5, a Deno program that opens a client WebSocket connection could be crashed by the remote server. While handling the WebSocket handshake response, Deno parsed the Sec-WebSocket-Protocol and Sec-WebSocket-Extensions response headers in a way that assumed their bytes were always printable ASCII. A response header containing non-visible-ASCII bytes (0x80-0xFF) caused a panic that aborted the entire Deno process. This vulnerability is fixed in 2.7.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-55517

CVE-2026-55517:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
deno	rust	<= 2.7.4	2.7.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the Deno WebSocket client's handling of handshake response headers. Specifically, the code does not gracefully handle cases where the Sec-WebSocket-Protocol and Sec-WebSocket-Extensions headers contain non-ASCII characters. The analysis of the patch commit 0ee75392669d26bc1e051ecd5bdc90b1997ad963 reveals that the op_ws_create function in ext/websocket/lib.rs is the point of failure. The original code used header.to_str().unwrap(), which assumes the header value is always valid UTF-8 and will panic if it's not. A remote attacker controlling the WebSocket server can send a specially crafted handshake response with invalid header bytes to crash the Deno client process. The patch replaces the unsafe .unwrap() calls with .and_then(|header| header.to_str().ok()) and .filter_map(|header| header.to_str().ok()), which safely handle invalid UTF-8 sequences by ignoring the problematic headers instead of crashing. Therefore, deno_websocket::op_ws_create is the vulnerable function that would appear in a runtime profile during exploitation.

Vulnerable functions

deno_websocket::op_ws_create

ext/websocket/lib.rs

The function `op_ws_create` processes WebSocket handshake responses. It unsafely unwraps the result of `to_str()` on the `Sec-WebSocket-Protocol` and `Sec-WebSocket-Extensions` headers. A malicious server can provide non-ASCII bytes in these headers, causing `to_str()` to return an error. The subsequent call to `unwrap()` triggers a panic, leading to a denial-of-service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.