CVE-2026-55517: Deno WebSocket Client Denial-of-Service Vulnerability

Technical summary

CVE-2026-55517 is a denial-of-service vulnerability in Deno's WebSocket client implementation. During the WebSocket handshake, Deno parses the Sec-WebSocket-Protocol and Sec-WebSocket-Extensions response headers with an unsafe assumption that their byte values fall within the printable ASCII range (0x00-0x7F). When a remote WebSocket server responds with headers containing bytes in the non-visible ASCII range (0x80-0xFF), the parser panics and terminates the entire Deno process. This occurs because the code does not validate or sanitize header bytes before processing, violating CWE-248 (Uncaught Exception). The vulnerability requires network access and user interaction (a Deno program must initiate the WebSocket connection), but no authentication or privileges are needed from the attacker's perspective.

Business impact

For organizations running Deno-based applications or services, this vulnerability creates an availability risk. Any user or service connecting to a malicious or compromised WebSocket endpoint will experience an unexpected process crash, disrupting whatever work was in progress. In production environments, this could trigger cascading failures if the crashed process handles critical operations. The impact is amplified in scenarios where Deno services are exposed to untrusted WebSocket servers or where user input influences which servers applications connect to. Patch deployment is straightforward and carries no backward-compatibility concerns.

Affected systems

All Deno installations prior to version 2.7.5 are affected. This includes any JavaScript, TypeScript, or WebAssembly application running on vulnerable Deno versions that uses the WebSocket client API (either directly or through a library). The vulnerability is triggered only when a program initiates an outbound WebSocket client connection, so server-side WebSocket listeners are not affected. Organizations should inventory Deno deployments and verify version numbers across development, staging, and production environments.

Exploitability

Exploitation is straightforward for an attacker who can control or intercept a WebSocket server endpoint. No special tools, authentication, or user privileges are required—only the ability to respond to a WebSocket handshake with a crafted response header. The attack requires user interaction in the sense that a Deno program must actively connect to the attacker's server, but this is a low bar in environments where applications consume external WebSocket APIs or where user-supplied URLs determine connection targets. Once triggered, the crash is reliable and immediate. However, real-world exploitation is somewhat limited by the attacker's need to position themselves as a WebSocket endpoint that a target application will connect to.

Remediation

Upgrade Deno to version 2.7.5 or later. This release fixes the header parsing logic to properly validate and handle non-ASCII bytes in Sec-WebSocket-Protocol and Sec-WebSocket-Extensions headers without panicking. Verify against the vendor advisory that your deployed version corresponds to 2.7.5 or a later stable release. No configuration changes or application code modifications are required.

Patch guidance

Patching requires updating your Deno binary. If you use a version manager (like dvm or asdf), update to Deno 2.7.5 or later using its standard update mechanism. If you manage Deno binaries directly, download the 2.7.5 release from the official Deno repository and replace your current binary, ensuring you test in a non-production environment first. Verify the patched version by running `deno --version`. No data migration, configuration changes, or rollback risks are associated with this update. Given the low CVSS score and the simplicity of patching, a standard change-management process is appropriate rather than emergency protocols.

Detection guidance

Monitor for unexpected Deno process terminations or crashes, particularly in applications that use WebSocket clients. Log collection from Deno processes may show panic messages or stack traces mentioning WebSocket header parsing. In network monitoring, look for WebSocket handshake responses containing non-ASCII bytes in header fields—though this is more relevant for identifying malicious servers than for incident response. If you suspect exploitation, review application logs for WebSocket connection attempts to external or suspicious endpoints around the time of crashes. Patching to 2.7.5 will automatically resolve the condition.

Why prioritize this

This vulnerability should be addressed promptly but does not warrant emergency response. While exploitable with low complexity, it requires either a user to connect to an attacker-controlled server or an attacker to intercept a legitimate WebSocket connection. The CVSS score of 4.3 (MEDIUM) reflects limited availability impact in most scenarios. However, applications that connect to untrusted or user-specified WebSocket endpoints face higher risk and should patch first. The patch is non-disruptive and carries no compatibility risks, making it a straightforward maintenance task.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a network-accessible, low-complexity denial-of-service vulnerability with no authentication required and no scope expansion. The score is held at MEDIUM rather than HIGH because the impact is limited to availability and requires either user interaction (a program must connect to the malicious server) or a specific attacker positioning (as a WebSocket endpoint). Availability impact is rated LOW because the vulnerability crashes only the affected Deno process, not the broader system, and there is no data loss or confidentiality/integrity compromise.

Frequently asked questions