deno_node

A modern runtime for JavaScript and TypeScript.

View on Cargo

View on Github

Activity

Latest release: 2w ago
Total releases: 198
Cadence: ~7 days
Last 12 months: 42

Reach

Downloads: 481.8k
Stars: 108.4k

Details

License: MIT
First release: Aug 11, 2022

Releases

Version	Released
`0.196.0` minor	Aug 27, 2026
`0.195.0` minor	Aug 06, 2026
`0.194.0` unknown	Jul 23, 2026
`0.193.0` unknown	Jul 15, 2026
`0.192.0` unknown	Jul 08, 2026
`0.191.0` unknown	Jul 01, 2026
`0.190.0` unknown	Jun 25, 2026
`0.189.0` unknown	Jun 11, 2026
`0.188.0` unknown	Jun 03, 2026
`0.187.0` unknown	May 27, 2026
`0.186.0` unknown	May 22, 2026
`0.185.0` unknown	Apr 28, 2026
`0.184.0` unknown	Apr 22, 2026
`0.183.0` unknown	Apr 09, 2026
`0.182.0` unknown	Apr 01, 2026
`0.181.0` unknown	Mar 31, 2026
`0.180.0` unknown	Mar 27, 2026
`0.179.0` unknown	Mar 25, 2026
`0.178.0` unknown	Mar 19, 2026
`0.177.0` unknown	Mar 18, 2026
`0.176.0` unknown	Mar 11, 2026
`0.175.0` unknown	Mar 05, 2026
`0.174.0` unknown	Mar 04, 2026
`0.173.0` unknown	Mar 03, 2026
`0.172.0` unknown	Feb 25, 2026
`0.171.0` unknown	Feb 25, 2026
`0.170.0` unknown	Feb 17, 2026
`0.169.0` unknown	Feb 10, 2026
`0.168.0` unknown	Feb 02, 2026
`0.167.0` unknown	Jan 29, 2026
`0.166.0` unknown	Jan 22, 2026
`0.165.0` unknown	Jan 15, 2026
`0.164.0` unknown	Jan 05, 2026
`0.163.0` unknown	Dec 20, 2025
`0.162.0` unknown	Dec 19, 2025
`0.161.0` unknown	Dec 15, 2025
`0.160.0` unknown	Dec 10, 2025
`0.142.1` unknown	Nov 14, 2025
`0.159.0` unknown	Oct 30, 2025
`0.158.0` unknown	Oct 28, 2025
`0.157.0` unknown	Oct 09, 2025
`0.156.0` unknown	Oct 03, 2025
`0.155.0` unknown	Sep 24, 2025
`0.154.0` unknown	Sep 17, 2025
`0.153.0` unknown	Sep 10, 2025
`0.152.0` unknown	Aug 21, 2025
`0.151.0` unknown	Aug 13, 2025
`0.150.0` unknown	Jul 31, 2025
`0.149.0` unknown	Jul 16, 2025
`0.148.0` unknown	Jul 08, 2025

1–50 of 198

Repository

denoland/deno

Forks: 6.4k
Open issues: 1.2k
Language: Rust
: 5.3/ 10

deno
typescript
javascript
rust

Dependencies (51)

Depends on

0.196.0

Used by

Supply-chain exposure

16 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (2)

CVE-2025-48935 GHSA-8vxj-4cph-c596 RUSTSEC-2025-0138 Jun 04, 2025

Deno has --allow-read / --allow-write permission bypass in `node:sqlite`

Medium
Network Low None None

Summary

It is possible to bypass Deno's read/write permission checks by using ATTACH DATABASE statement.

PoC

// poc.js import { DatabaseSync } from "node:sqlite" const db = new DatabaseSync(":memory:"); db.exec("ATTACH DATABASE 'test.db' as test;"); db.exec("CREATE TABLE test.test (id INTEGER PRIMARY KEY, name TEXT);");

$ deno poc.js

Fixed in

0.134.0

References

https://github.com/denoland/deno/security/advisories/GHSA-8vxj-4cph-c596
https://nvd.nist.gov/vuln/detail/CVE-2025-48935
https://github.com/denoland/deno/commit/31a97803995bd94629528ba841b2418d3ca01860
https://github.com/denoland/deno
https://rustsec.org/advisories/RUSTSEC-2025-0138.html

Updated Feb 03, 2026 · Source: OSV.dev
CVE-2025-24015 GHSA-2x3r-hwv5-p32x Jun 04, 2025

Deno's AES GCM authentication tags are not verified

High
Network Low None None

Summary

This affects AES-256-GCM and AES-128-GCM in Deno, introduced by commit 0d1beed. Specifically, the authentication tag is not being validated. This means tampered ciphertexts or incorrect keys might not be detected, which breaks the guarantees expected from AES-GCM. Older versions of Deno correctly threw errors in such cases, as does Node.js.

Without authentication tag verification, AES-GCM degrades to essentially CTR mode, removing integrity protection. Authenticated data set with set_aad is also affected, as it is incorporated into the GCM hash (ghash) but this too is not validated, rendering AAD checks ineffective.

PoC

import { Buffer } from "node:buffer"; import { createCipheriv, createDecipheriv, randomBytes, scrypt, } from "node:crypto"; type Encrypted = { salt: string; iv: string; enc: string; authTag: string; }; const deriveKey = (key: string, salt: Buffer) => new Promise<Buffer>((res, rej) => scrypt(key, salt, 32, (err, k) => { if (err) rej(err); else res(k); }) ); async function encrypt(text: string, key: string): Promise<Encrypted> { const salt = randomBytes(32); const k = await deriveKey(key, salt); const iv = randomBytes(16); const enc = createCipheriv("aes-256-gcm", k, iv); const ciphertext = enc.update(text, "binary", "binary") + enc.final("binary"); return { salt: salt.toString("binary"), iv: iv.toString("binary"), enc: ciphertext, authTag: enc.getAuthTag().toString("binary"), }; } async function decrypt(enc: Encrypted, key: string) { const k = await deriveKey(key, Buffer.from(enc.salt, "binary")); const dec = createDecipheriv("aes-256-gcm", k, Buffer.from(enc.iv, "binary")); const out = dec.update(enc.enc, "binary", "binary"); dec.setAuthTag(Buffer.from(enc.authTag, "binary")); return out + dec.final("binary"); } const test = await encrypt("abcdefghi", "key"); test.enc = ""; console.log(await decrypt(test, "")); // no error

Impact

While discovered through experimentation, authentication failures that should raise errors may be silently ignored.

Fixed in

0.125.0

References

https://github.com/denoland/deno/security/advisories/GHSA-2x3r-hwv5-p32x
https://nvd.nist.gov/vuln/detail/CVE-2025-24015
https://github.com/denoland/deno/commit/0d1beed
https://github.com/denoland/deno/commit/0d1beed2e3633d71d5e288e0382b85be361ec13d
https://github.com/denoland/deno/commit/4f27d7cdc02e3edfb9d36275341fb8185d6e99ed
https://github.com/denoland/deno/commit/a4003a5292bd0affefad3ecb24a8732886900f67

Updated Sep 10, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

minor 2
unknown 196

198 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More