CVE-2023-26103

Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s*,s*/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used to significantly slow down a web socket server.

• CWE-1333
• CWE-1333
• CWE-1333

• https://github.com/denoland/deno/blob/2b247be517d789a37e532849e2e40b724af0918f/ext/http/01_http.js%23L395-L409Broken Link
• https://github.com/denoland/deno/commit/cf06a7c7e672880e1b38598fe445e2c50b4a9d06Patch
• https://github.com/denoland/deno/pull/17722Patch
• https://github.com/denoland/deno/releases/tag/v1.31.0Release Notes
• https://security.snyk.io/vuln/SNYK-RUST-DENO-3315970Exploit, Technical Description, Third Party Advisory
• https://github.com/denoland/deno/blob/2b247be517d789a37e532849e2e40b724af0918f/ext/http/01_http.js%23L395-L409Broken Link
• https://github.com/denoland/deno/commit/cf06a7c7e672880e1b38598fe445e2c50b4a9d06Patch
• https://github.com/denoland/deno/pull/17722Patch
• https://github.com/denoland/deno/releases/tag/v1.31.0Release Notes
• https://security.snyk.io/vuln/SNYK-RUST-DENO-3315970Exploit, Technical Description, Third Party Advisory

Published

Feb 25, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26098An issue was discovered in the Open Document feature in Teli…7.8
• CVE-2023-26099An issue was discovered in Telindus Apsal 3.14.2022.235 b. T…7.1
• CVE-2023-2610Integer Overflow or Wraparound in GitHub repository vim/vim …7.8
• CVE-2023-26100In Progress Flowmon before 12.2.0, an application endpoint f…6.1
• CVE-2023-26101In Progress Flowmon Packet Investigator before 12.1.0, a Flo…7.5
• CVE-2023-26102All versions of the package rangy are vulnerable to Prototyp…8.2
• CVE-2023-26104All versions of the package lite-web-server are vulnerable t…7.5
• CVE-2023-26105All versions of the package utilities are vulnerable to Prot…7.5
• CVE-2023-26106All versions of the package dot-lens are vulnerable to Proto…7.5
• CVE-2023-26107All versions of the package sketchsvg are vulnerable to Arbi…7.8
• CVE-2023-26108Versions of the package @nestjs/core before 9.0.5 are vulner…5.3
• CVE-2023-26109All versions of the package node-bluetooth-serial-port are v…9.8