CVE-2026-55517: Deno Runtime DoS Vulnerability

CVE-2026-55517 Overview

CVE-2026-55517 affects Deno, a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.7.5 contain a flaw in the WebSocket client handshake handling. A Deno program that opens a client WebSocket connection can be crashed by the remote server. The runtime parses the Sec-WebSocket-Protocol and Sec-WebSocket-Extensions response headers assuming all bytes are printable ASCII. A response header containing non-visible ASCII bytes in the range 0x80-0xFF triggers a panic that aborts the entire Deno process. The issue is tracked under [CWE-248: Uncaught Exception] and is fixed in Deno 2.7.5.

Critical Impact
A malicious or compromised WebSocket server can crash any Deno process that connects to it, producing a denial of service against the client application.

Affected Products

Deno runtime versions prior to 2.7.5
Applications using Deno's built-in WebSocket client APIs
Services that initiate outbound WebSocket connections to untrusted endpoints

Discovery Timeline

2026-06-23 - CVE-2026-55517 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-55517

Vulnerability Analysis

The vulnerability resides in Deno's WebSocket client handshake processing. When a Deno program establishes a WebSocket connection, the server returns an HTTP 101 Switching Protocols response containing optional Sec-WebSocket-Protocol and Sec-WebSocket-Extensions headers. Deno parses these header values under the assumption that they only contain printable ASCII characters between 0x20 and 0x7E.

When a server returns header bytes in the range 0x80-0xFF, the parsing routine fails an internal invariant and raises an uncaught Rust panic. Deno does not recover from this panic at the runtime boundary, so the entire process terminates. Any unsaved state, in-flight requests, or concurrent tasks are lost when the process aborts.

The vulnerability does not allow code execution or data disclosure. The CVSS impact reflects availability only, with no confidentiality or integrity impact. Exploitation requires that the Deno application initiate a WebSocket connection to an attacker-controlled or attacker-influenced server.

Root Cause

The root cause is improper input validation in the WebSocket handshake response parser. The parser converts raw header bytes to text without first validating that all bytes fall within the expected ASCII range. The resulting panic is classified under [CWE-248] because the error path is not handled gracefully by the surrounding runtime.

Attack Vector

An attacker controlling a WebSocket server, or capable of intercepting and modifying server responses, returns a handshake response with a crafted Sec-WebSocket-Protocol or Sec-WebSocket-Extensions header containing at least one byte in the 0x80-0xFF range. Any Deno client below 2.7.5 connecting to that endpoint terminates immediately. The attack requires user interaction in the sense that the Deno program must initiate the outbound connection.

No verified public exploit code is available. The vulnerability mechanism is described in the GitHub Security Advisory GHSA-x2qc-cmh9-f4hf.

Detection Methods for CVE-2026-55517

Indicators of Compromise

Unexpected termination of Deno processes shortly after establishing outbound WebSocket connections
Rust panic messages referencing WebSocket header parsing in process logs or stderr
Repeated crash-restart loops in Deno workloads that connect to external WebSocket endpoints
Outbound WebSocket traffic to untrusted or recently registered domains preceding process aborts

Detection Strategies

Inventory Deno runtime versions across servers, containers, and CI runners and flag any version below 2.7.5
Monitor process exit codes and stderr for Rust panic signatures originating from Deno workloads
Inspect network telemetry for WebSocket handshake responses containing non-printable bytes in protocol or extension headers
Correlate Deno process restarts with outbound WebSocket session establishment to identify likely triggers

Monitoring Recommendations

Centralize Deno application logs and alert on abnormal termination rates
Track outbound WebSocket connections to external hosts and apply allowlists where feasible
Enable host-based telemetry to capture process lifecycle events and parent-child relationships for Deno workloads

How to Mitigate CVE-2026-55517

Immediate Actions Required

Upgrade all Deno installations to version 2.7.5 or later
Audit applications that use the built-in WebSocket client and identify external endpoints they connect to
Restrict outbound WebSocket destinations to trusted hosts where the application design permits
Ensure Deno workloads run under process supervisors that detect crash loops and rate-limit restarts

Patch Information

The Deno project released a fix in version 2.7.5. The patch validates header bytes before parsing the Sec-WebSocket-Protocol and Sec-WebSocket-Extensions values, returning a handled error rather than panicking on non-ASCII input. Refer to the GitHub Security Advisory GHSA-x2qc-cmh9-f4hf for upstream release details.

Workarounds

Avoid initiating WebSocket connections to untrusted servers until the runtime is upgraded
Place a trusted reverse proxy between Deno clients and external WebSocket servers to normalize and validate handshake responses
Run Deno workloads inside a supervised container with automatic restart and resource quotas to limit denial-of-service impact

bash

# Upgrade Deno to the patched release
deno upgrade --version 2.7.5

# Verify the installed version
deno --version