crates.io deno_node vulnerabilities

Latest crates.io deno_node CVEs

Newest publication first

1. CVE-2025-48935 Deno has --allow-read / --allow-write permission bypass in `node:sqlite`

   Published 2025-06-04

   Medium·CVSS 5.5 EPSS 0.49%

   Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 2.2.0 and prior to versions 2.2.5, it is possible to bypass Deno's permission read/write db permission check by using ATTACH DATABASE statement. Version 2.2.5 contains a patch for the issue.

2. CVE-2025-24015 Deno's AES GCM authentication tags are not verified

   Published 2025-06-03

   High·CVSS 7.7 EPSS 0.29%

   Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions 1.46.0 through 2.1.6 have an issue that affects AES-256-GCM and AES-128-GCM in Deno in which the authentication tag is not being validated. This means tampered ciphertexts or incorrect keys might not be detected,...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.