Read the docs
TI-2026-18355 Aliases CVE-2026-22863GHSA-5379-f5hf-w38v

Deno node:crypto doesn't finalize cipher

Priority MEDIUM 45CWE-325Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.6.0, node:crypto doesn't finalize cipher. The vulnerability allows an attacker to have infinite encryptions. This can lead to naive attempts at brute forcing, as well as more refined attacks with the goal to learn the server secrets. This vulnerability is fixed in 2.6.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00204 10th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed deno (denoland): 2.6.0deno (crates.io): 2.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
denolanddenobefore 2.6.02.6.0Patch availableCNA
—deno (crates.io)before 2.6.02.6.0Patch availableGHSA-5379-f5hf-w38v
  • deno Vendordenoland Affected before 2.6.0 Fixed in 2.6.0 Patch available CNA
  • deno (crates.io) Vendor— Affected before 2.6.0 Fixed in 2.6.0 Patch available GHSA-5379-f5hf-w38v

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*before 2.6.0Vulnerabledenoland
  • cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:* Versions before 2.6.0 Vulnerable ·denoland

Remediation

  • Fix · CNA deno (denoland) Fixed in 2.6.0
  • Fix · GHSA-5379-f5hf-w38v deno (crates.io) Fixed in 2.6.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-22863
  2. 2026-10-03 Alias added: GHSA-5379-f5hf-w38v

References

Exploit 1

Advisory 1

Other 2

  • TI-2026-21627 Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process CVSS 3.1CRITICAL 9.8
  • TI-2025-17782 Deno's AES GCM authentication tags are not verified CVSS 4.0HIGH 7.7
  • TI-2024-18537 *const c_void / ExternalPointer unsoundness leading to use-after-free CVSS 3.1HIGH 8.8
  • TI-2024-18536 Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass CVSS 3.1HIGH 8.8
  • TI-2023-12990 Deno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralization CVSS 3.1HIGH 8.8
  • TI-2023-11328 Regular expression denial of service in deno CVSS 3.1HIGH 7.5
See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences