TI-2026-36596 Aliases CVE-2026-49440 GHSA-9xg4-qhm4-g43w

Deno: Miller-Rabin Primality Test Allows Zero Rounds

LOW 34CWE-325Published 2026-06-23 · Updated 2026-06-25

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, node:crypto.checkPrime(candidate[, options][, callback]) and crypto.checkPrimeSync(candidate[, options]) ran no Miller-Rabin rounds at all when the caller left options.checks at its default of 0. In that mode, the only test applied to the candidate was trial division by the primes up to 17,863. Any composite whose smallest prime factor exceeds that bound — for example the product of two primes just above it, such as 17,881 × 17,891 — was reported as true ("probably prime"). The same divergence affected the lower-level op_node_check_prime / op_node_check_prime_bytes paths that the polyfill calls into. This vulnerability is fixed in 2.8.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00237 14th percentileScored 2026-11-07

Fix Fixed deno (denoland): 2.8.1deno (crates.io): 2.8.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
denoland	deno	before 2.8.1	2.8.1	Patch available	CNA
—	deno (crates.io)	before 2.8.1	2.8.1	Patch available	GHSA-9xg4-qhm4-g43w

deno Vendordenoland Affected before 2.8.1 Fixed in 2.8.1 Patch available CNA
deno (crates.io) Vendor— Affected before 2.8.1 Fixed in 2.8.1 Patch available GHSA-9xg4-qhm4-g43w

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:deno:deno::::::::	before 2.8.1	Vulnerable	denoland

cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:* Versions before 2.8.1 Vulnerable ·denoland

Remediation

Fix · CNA deno (denoland) Fixed in 2.8.1
Fix · GHSA-9xg4-qhm4-g43w deno (crates.io) Fixed in 2.8.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-49440
2026-10-03 Alias added: GHSA-9xg4-qhm4-g43w

References

Advisory 1

https://github.com/denoland/deno/security/advisories/GHSA-9xg4-qhm4-g43w

Other 2

TI-2026-21627 Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process CVSS 3.1CRITICAL 9.8
TI-2025-17782 Deno's AES GCM authentication tags are not verified CVSS 4.0HIGH 7.7
TI-2024-18537 *const c_void / ExternalPointer unsoundness leading to use-after-free CVSS 3.1HIGH 8.8
TI-2024-18536 Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass CVSS 3.1HIGH 8.8
TI-2023-12990 Deno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralization CVSS 3.1HIGH 8.8
TI-2023-11328 Regular expression denial of service in deno CVSS 3.1HIGH 7.5

See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences