CVE-2026-55517: Deno Denial of Service Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-x2qc-cmh9-f4hf",
  "modified" : "2026-06-17T18:48:18Z",
  "published" : "2026-06-17T18:48:18Z",
  "aliases" : [ "CVE-2026-55517" ],
  "summary" : "Deno: Denial of service via non-ASCII bytes in WebSocket response headers",
  "details" : "## Summary\n\nA Deno program that opens a client `WebSocket` connection could be crashed by\nthe remote server. While handling the WebSocket handshake response, Deno parsed\nthe `Sec-WebSocket-Protocol` and `Sec-WebSocket-Extensions` response headers in\na way that assumed their bytes were always printable ASCII. A response header\ncontaining non-visible-ASCII bytes (`0x80`-`0xFF`) caused a panic that aborted\nthe entire Deno process.\n\n## Details\n\nWhen establishing a client WebSocket connection, Deno read the\n`Sec-WebSocket-Protocol` and `Sec-WebSocket-Extensions` headers from the\nserver's `101 Switching Protocols` response and converted them to strings\nwithout handling the failure case. `HeaderValue::to_str()` returns an error for\nany value containing bytes outside the visible-ASCII range, so a header carrying\nsuch bytes triggered an unrecoverable error during conversion.\n\nBecause the client initiates the outbound connection, the handshake response is\nfully controlled by the server. A server that returns bytes such as `0xFF 0xFE`\nin either header could therefore crash any client that connected to it.\n\nThis is purely an availability issue. There is no information disclosure and no\nmemory-safety impact; the only effect is termination of the current process.\n\n## Impact\n\nRemote denial of service. Any Deno application that establishes WebSocket\nconnections to untrusted or potentially-compromised endpoints could be\nterminated by the remote peer. Exploitation requires the victim application to\ninitiate the outbound WebSocket connection. An attacker who controls the\nWebSocket endpoint, or who can man-in-the-middle a plaintext `ws://` connection,\ncould trigger the crash. The effect is confined to crashing the process that\nopened the connection.\n\n## Patch\n\nThe issue is fixed in Deno `2.7.5`. The header values are now parsed with\ngraceful fallbacks: values that cannot be represented as ASCII strings are\nskipped instead of aborting the process. A regression test covers a server that\nreturns non-ASCII bytes in `Sec-WebSocket-Protocol`.\n\nUsers should upgrade to Deno `2.7.5` or later.\n\n## Workarounds\n\nUntil you can upgrade, only connect to trusted WebSocket endpoints and prefer\n`wss://` (TLS) over `ws://`, which prevents a network man-in-the-middle from\ninjecting malicious header bytes into the handshake response.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "deno"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.7.5"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.7.4"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/denoland/deno/security/advisories/GHSA-x2qc-cmh9-f4hf"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/denoland/deno"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-248" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-17T18:48:18Z",
    "nvd_published_at" : null
  }
}