high8.6
CVE-2023-33966
Missing "--allow-net" permission check for built-in Node modules
Impact
### Impact Outbound HTTP requests made using the built-in "node:http" or "node:https" modules are incorrectly not checked against the network permission allow list (`--allow-net`). Dependencies relying on these built-in modules are subject to the vulnerability too. Users of Deno versions prior to 1.34.0 are unaffected. Deno Deploy users are unaffected. ### Patches This problem has been patched in Deno v1.34.1 and all users are recommended to update to this version. ### Workarounds No workaround is available for this issue.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | deno | = 1.34.0 | 1.34.1 |
| rust | deno_runtime | = 0.114.0 | 0.115.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Deno | Deno | Version 1.34.0 |
| Deno | Deno Runtime | Version 0.114.0 |