CVE-2026-22864 is a high severity flaw (CVSS 8.1) in Deno, the JavaScript, TypeScript and WebAssembly runtime. A check meant to stop spawning Windows batch files compared file extensions case sensitively, so .BAT or .Bat slipped past it. The fix is in Deno 2.5.6, and any older version should be upgraded.
What's affected
Deno versions before 2.5.6 are affected. The record lists Deno 2.5.6 as the fixed version.
The weakness sits in an earlier patch. That patch returned an error when a spawned path ended in .bat or .cmd, but it compared against lowercase text only. Windows treats file extensions without regard to case, so the same file runs either way.
How to check if you're exposed
Print your runtime version and compare it with 2.5.6:
deno --version
If you build container images or CI runners that install Deno, check those too. They often pin an older release than your laptop. Search your pipeline files for the pinned Deno version and confirm each one is 2.5.6 or later.
The risk is highest where Deno runs code you did not write on Windows and relies on the spawn block as a guard. If you only run your own trusted scripts, the practical exposure is lower, but the upgrade is cheap.
What to do now
- Run
deno upgradeon every machine and runner, or install 2.5.6 or later from the project releases. - Update version pins in Dockerfiles, CI configs and setup scripts.
- Re-run
deno --versionon each target to confirm. - If you run untrusted scripts, keep Deno permission flags tight rather than depending on a single check.
Why it matters
The class is CWE-77 (Command Injection). The runtime tried to filter a dangerous action by matching a string, and the match was easy to sidestep because the filter and the operating system disagree about case.
String filters on file names and commands tend to fail this way. The reliable pattern is to normalize the input first, or to allow only an explicit list of known good values. The advisory describes this as a bypass of an earlier fix, which is a reminder to test patches against variants, not just the reported case. The record does not say this CVE is exploited in the wild.
Quick check
Is CVE-2026-22864 exploited in the wild?
The record does not mark it as a CISA Known Exploited Vulnerability, and the sources we read do not report exploitation.
Which version fixes it?
Deno 2.5.6.
Sources
Last reviewed: 19 October 2026.
