CVE-2023-33966

Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and deno_runtime 0.114.0, outbound HTTP requests made using the built-in `node:http` or `node:https` modules are incorrectly not checked against the network permission allow list (`--allow-net`). Dependencies relying on these built-in modules are subject to the vulnerability too. Users of Deno versions prior to 1.34.0 are unaffected. Deno Deploy users are unaffected. This problem has been patched in Deno v1.34.1 and deno_runtime 0.114.1 and all users are recommended to update to this version. No workaround is available for this issue.

• CWE-269
• CWE-276

• https://github.com/denoland/deno/releases/tag/v1.34.1Release Notes
• https://github.com/denoland/deno/security/advisories/GHSA-vc52-gwm3-8v2fVendor Advisory
• https://github.com/denoland/deno/releases/tag/v1.34.1Release Notes
• https://github.com/denoland/deno/security/advisories/GHSA-vc52-gwm3-8v2fVendor Advisory

Published

May 31, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-33960OpenProject is web-based project management software. For an…7.5
• CVE-2023-33961Leantime is a lean open source project management system. St…5.4
• CVE-2023-33962JStachio is a type-safe Java Mustache templating engine. Pr…6.1
• CVE-2023-33963DataEase is an open source data visualization and analysis t…9.8
• CVE-2023-33964mx-chain-go is an implementation of the MultiversX blockchai…7.5
• CVE-2023-33965Brook is a cross-platform programmable network tool. The `tp…8.8
• CVE-2023-33967EaseProbe is a tool that can do health/status checking. An S…9.8
• CVE-2023-33968Kanboard is open source project management software that foc…5.4
• CVE-2023-33969Kanboard is open source project management software that foc…5.4
• CVE-2023-3397A race condition occurred between the functions lmLogClose a…6.3
• CVE-2023-33970Kanboard is open source project management software that foc…6.5
• CVE-2023-33971Formcreator is a GLPI plugin which allow creation of custom …5.4