Is deno safe to use? Its security history

Every advisory, newest first

• VulnerabilityGHSA-x2qc-cmh9-f4hf · 2026-06-17Deno: Denial of service via non-ASCII bytes in WebSocket response headers
• VulnerabilityGHSA-8xpq-cjcf-3wh9 · 2026-06-16Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)
• VulnerabilityGHSA-968w-xfqw-vp9q · 2026-06-16Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions
• VulnerabilityGHSA-v8fw-85r8-5m23 · 2026-06-16Deno: Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks
• VulnerabilityGHSA-9xg4-qhm4-g43w · 2026-06-16Deno: Miller-Rabin Primality Test Allows Zero Rounds
• VulnerabilityGHSA-7xh3-mhg9-jcw8 · 2026-06-16Deno: Command Injection via spawnSync & spawn on Windows
• VulnerabilityGHSA-4c8g-jvcx-v4hv · 2026-06-16Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access
• VulnerabilityGHSA-83pc-3rw9-qpwj · 2026-06-16Deno: WebSocket API sandbox bypass via missing post-DNS check
• VulnerabilityGHSA-cpgj-f7g3-2pp2 · 2026-06-16Deno: `fetch()` API sandbox bypass via missing DNS resolution check
• VulnerabilityGHSA-chqv-56wv-7564 · 2026-05-27Deno's TLS retry copies stale upgrade hook, risking plaintext traffic
• VulnerabilityGHSA-4c96-w8v2-p28j · 2026-03-13Deno vulnerable to command Injection via incomplete shell metacharacter blocklist in node:child_process
• VulnerabilityGHSA-hmh4-3xvx-q5hr · 2026-02-19Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process
• VulnerabilityGHSA-m3c4-prhw-mrx6 · 2026-01-16Deno has an incomplete fix for command-injection prevention on Windows , case-insensitive extension bypass
• VulnerabilityGHSA-5379-f5hf-w38v · 2026-01-16Deno node:crypto doesn't finalize cipher
• VulnerabilityGHSA-m2gf-x3f6-8hq3 · 2025-10-08Deno is Vulnerable to Command Injection on Windows During Batch File Execution
• VulnerabilityGHSA-qq26-84mh-26j9 · 2025-10-08Deno's --deny-read check does not prevent permission bypass
• VulnerabilityGHSA-vg2r-rmgp-cgqj · 2025-10-07Deno's --deny-write check does not prevent permission bypass
• VulnerabilityGHSA-jv4x-jv3h-qff5 · 2025-06-05Deno vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
• VulnerabilityGHSA-7w8p-chxq-2789 · 2025-06-04Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables
• VulnerabilityGHSA-7w8p-chxq-2789 · 2025-06-04Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables
• VulnerabilityGHSA-xqxc-x6p3-w683 · 2025-06-04Deno run with --allow-read and --deny-read flags results in allowed
• VulnerabilityGHSA-xqxc-x6p3-w683 · 2025-06-04Deno run with --allow-read and --deny-read flags results in allowed
• VulnerabilityGHSA-xqxc-x6p3-w683 · 2025-06-04Deno run with --allow-read and --deny-read flags results in allowed
• VulnerabilityGHSA-2x3r-hwv5-p32x · 2025-06-04Deno's AES GCM authentication tags are not verified
• VulnerabilityRUSTSEC-2025-0138 · 2025-06-03--allow-read / --allow-write permission bypass in `node:sqlite`
• VulnerabilityGHSA-f27p-cmv8-xhm6 · 2025-01-06fetch: Authorization headers not dropped when redirecting cross-origin
• VulnerabilityGHSA-f27p-cmv8-xhm6 · 2025-01-06fetch: Authorization headers not dropped when redirecting cross-origin
• VulnerabilityGHSA-23rx-c3g5-hv9w · 2024-05-08Deno permission escalation vulnerability via open of privileged files with missing `--deny` flag
• VulnerabilityGHSA-3j27-563v-28wf · 2024-03-06*const c_void / ExternalPointer unsoundness leading to use-after-free
• VulnerabilityGHSA-6q4w-9x56-rmwq · 2024-03-06Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass
• VulnerabilityGHSA-5frw-4rwq-xhcr · 2024-03-06Deno's improper suffix match testing for DENO_AUTH_TOKENS
• VulnerabilityGHSA-m4pq-fv2w-6hrw · 2024-03-05Deno's deno_runtime vulnerable to interactive permission prompt spoofing via improper ANSI stripping
• VulnerabilityGHSA-wrqv-pf6j-mqjp · 2024-03-05Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination
• VulnerabilityGHSA-hrqr-jv8w-v9jh · 2024-03-05Insufficient permission checking in `Deno.makeTemp*` APIs
• VulnerabilityGHSA-vc52-gwm3-8v2f · 2023-05-31Missing "--allow-net" permission check for built-in Node modules
• VulnerabilityGHSA-jc97-h3h9-7xh6 · 2023-04-03Regular Expression Denial of Service in Deno.upgradeWebSocket API
• VulnerabilityGHSA-vq67-rp93-65qf · 2023-03-24Interactive `run` permission prompt spoofing via improper ANSI neutralization
• VulnerabilityGHSA-mc52-jpm2-cqh6 · 2023-01-20Deno is vulnerable to race condition via interactive permission prompt spoofing
• VulnerabilityGHSA-67hm-27mx-9cg7 · 2022-06-13Link Following in Deno
• VulnerabilityGHSA-838h-jqp6-cf2f · 2022-03-29Sandbox bypass leading to arbitrary code execution in Deno
• VulnerabilityGHSA-xpwj-7v8q-mcgj · 2021-09-23Deno's static imports inside dynamically imported modules do not adhere to permission checks

Check your version

Run cargo tree -i deno to see which version you build and why, or paste your Cargo.lock into the Cargo.toml checker to match every advisory against your exact versions.

RustSec advisories (CC0-1.0) and GitHub-reviewed advisories via OSV's crates.io export, downloaded Oct 24, 2026.