UpHeron
All vulnerabilities

Servers and applications

CVE-2023-33966

Missing "--allow-net" permission check for built-in Node modules

Severity
Critical 9.8
Published
30 May 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Also known as
GHSA-vc52-gwm3-8v2f
Sources
NVD, Project advisories (GitHub)

Description

Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and deno_runtime 0.114.0, outbound HTTP requests made using the built-in `node:http` or `node:https` modules are incorrectly not checked against the network permission allow list (`--allow-net`). Dependencies relying on these built-in modules are subject to the vulnerability too. Users of Deno versions prior to 1.34.0 are…

Affected software

SoftwareAffected versions
DenoServers and applications · cpe:a:deno:deno
  • Version 1.34.0
DenoServers and applications · github:denoland/deno
  • Version 1.34.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-33966
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-33966
  • GitHub Advisory Database https://github.com/advisories/GHSA-vc52-gwm3-8v2f
  • github.com https://github.com/denoland/deno/security/advisories/GHSA-vc52-gwm3-8v2f