Critical severity · published May 31, 2023
CVE-2023-33966
Deno missing "--allow-net" permission check for built-in Node modules
9.8
CVSS
0.6%
EPSS
No
On KEV
Description
Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and deno_runtime 0.114.0, outbound HTTP requests made using the built-in `node:http` or `node:https` modules are incorrectly not checked against the network permission allow list (`--allow-net`). Dependencies relying on these built-in modules are subject to the vulnerability too. Users of Deno versions prior to 1.34.0 are unaffected. Deno Deploy users are unaffected. This problem has been patched in Deno v1.34.1 and deno_runtime 0.114.1 and all users are recommended to update to this version. No workaround is available for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DE
deno · denoland
deno = 1.34.0; deno_runtime = 0.114.0 · source: vendor, NVD
DR
Deno Runtime · Deno
0.114.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-33966
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-33966
Release Notes
https://github.com/denoland/deno/releases/tag/v1.34.1
Vendor Advisory
https://github.com/denoland/deno/security/advisories/GHSA-vc52-gwm3-8v2f
More from deno
9.8
CVE-2026-32260
Command Injection via incomplete shell metacharacter blocklist in node:child_process (bypass of CVE-2026-27190 fix)
9.8
CVE-2026-27190
Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process
9.8
CVE-2026-22864
Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass
9.8
CVE-2023-28445
Deno improperly handles resizable ArrayBuffer
9.1
CVE-2026-44726
Deno: TLS retry copies stale upgrade hook, risking plaintext traffic