GHSA-vc52-gwm3-8v2f
Missing "--allow-net" permission check for built-in Node modules
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| crates.io | deno | >= 1.34.0, < 1.34.1 | 1.34.1 |
| crates.io | deno_runtime | >= 0.114.0, < 0.115.0 | 0.115.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Outbound HTTP requests made using the built-in "node:http" or "node:https" modules are incorrectly not checked against the network permission allow list (`--allow-net`). Dependencies relying on these built-in modules are subject to the vulnerability too.
Users of Deno versions prior to 1.34.0 are unaffected. Deno Deploy users are unaffected.
### Patches
This problem has been patched in Deno v1.34.1 and all users are recommended to update to this version.
### Workarounds
No workaround is available for this issue.
References
External links from the advisory. They lead to third-party sites.