{"id":"JLSEC-2026-1167","summary":"Deno: Denial of service via non-ASCII bytes in WebSocket response headers","details":"## Summary\n\nA Deno program that opens a client `WebSocket` connection could be crashed by\nthe remote server. While handling the WebSocket handshake response, Deno parsed\nthe `Sec-WebSocket-Protocol` and `Sec-WebSocket-Extensions` response headers in\na way that assumed their bytes were always printable ASCII. A response header\ncontaining non-visible-ASCII bytes (`0x80`-`0xFF`) caused a panic that aborted\nthe entire Deno process.\n\n## Details\n\nWhen establishing a client WebSocket connection, Deno read the\n`Sec-WebSocket-Protocol` and `Sec-WebSocket-Extensions` headers from the\nserver's `101 Switching Protocols` response and converted them to strings\nwithout handling the failure case. `HeaderValue::to_str()` returns an error for\nany value containing bytes outside the visible-ASCII range, so a header carrying\nsuch bytes triggered an unrecoverable error during conversion.\n\nBecause the client initiates the outbound connection, the handshake response is\nfully controlled by the server. A server that returns bytes such as `0xFF 0xFE`\nin either header could therefore crash any client that connected to it.\n\nThis is purely an availability issue. There is no information disclosure and no\nmemory-safety impact; the only effect is termination of the current process.\n\n## Impact\n\nRemote denial of service. Any Deno application that establishes WebSocket\nconnections to untrusted or potentially-compromised endpoints could be\nterminated by the remote peer. Exploitation requires the victim application to\ninitiate the outbound WebSocket connection. An attacker who controls the\nWebSocket endpoint, or who can man-in-the-middle a plaintext `ws://` connection,\ncould trigger the crash. The effect is confined to crashing the process that\nopened the connection.\n\n## Patch\n\nThe issue is fixed in Deno `2.7.5`. The header values are now parsed with\ngraceful fallbacks: values that cannot be represented as ASCII strings are\nskipped instead of aborting the process. A regression test covers a server that\nreturns non-ASCII bytes in `Sec-WebSocket-Protocol`.\n\nUsers should upgrade to Deno `2.7.5` or later.\n\n## Workarounds\n\nUntil you can upgrade, only connect to trusted WebSocket endpoints and prefer\n`wss://` (TLS) over `ws://`, which prevents a network man-in-the-middle from\ninjecting malicious header bytes into the handshake response.","modified":"2026-08-05T18:36:54.154086364Z","published":"2026-08-05T18:20:40.259Z","upstream":["CVE-2026-55517","EUVD-2026-38549","GHSA-x2qc-cmh9-f4hf"],"database_specific":{"sources":[{"id":"CVE-2026-55517","imported":"2026-08-05T06:30:31.317Z","modified":"2026-06-29T13:27:11.020Z","published":"2026-06-23T18:18:09.787Z","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-55517","html_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55517","database_specific":{"status":"Analyzed"}},{"id":"GHSA-x2qc-cmh9-f4hf","imported":"2026-08-05T06:30:40.460Z","modified":"2026-06-17T18:48:18Z","published":"2026-06-17T18:48:18Z","url":"https://api.github.com/advisories/GHSA-x2qc-cmh9-f4hf","html_url":"https://github.com/advisories/GHSA-x2qc-cmh9-f4hf"},{"html_url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-38549","id":"EUVD-2026-38549","imported":"2026-08-05T06:30:31.318Z","modified":"2026-06-23T17:52:56Z","published":"2026-06-23T17:24:59Z","url":"https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2026-38549"}],"license":"CC-BY-4.0"},"references":[{"type":"WEB","url":"https://github.com/advisories/GHSA-x2qc-cmh9-f4hf"},{"type":"WEB","url":"https://github.com/denoland/deno/security/advisories/GHSA-x2qc-cmh9-f4hf"}],"affected":[{"package":{"name":"Deno_jll","ecosystem":"Julia","purl":"pkg:julia/Deno_jll?uuid=04572ae6-984a-583e-9378-9577a1c2574d"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.8.1+0"}]}],"database_specific":{"source":"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-1167.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"}],"credits":[{"name":"snoopysecurity","contact":["https://github.com/snoopysecurity"],"type":"REPORTER"}]}