PT-2025-23677 · Deno · Deno

Canislupaster · Published 2025-06-03 · Updated 2026-04-14 · CVE-2025-24015

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Deno versions 1.46.0 through 2.1.6

Description The issue affects AES-256-GCM and AES-128-GCM in Deno, where the authentication tag is not being validated. This means tampered ciphertexts or incorrect keys might not be detected, which breaks the guarantees expected from AES-GCM. Without authentication tag verification, AES-GCM degrades to essentially CTR mode, removing integrity protection. Authenticated data set with set aad is also affected, as it is incorporated into the GCM hash (ghash) but this too is not validated, rendering AAD checks ineffective.

Recommendations For Deno versions 1.46.0 through 2.1.6, update to version 2.1.7 or later to address the issue. As a temporary workaround, consider disabling the use of AES-256-GCM and AES-128-GCM until a patch is available. Restrict access to the affected createCipheriv and createDecipheriv functions to minimize the risk of exploitation. Avoid using the set aad function in the affected API endpoints until the issue is resolved.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2025-24015

GHSA-2X3R-HWV5-P32X

JLSEC-2026-108

Affected Products

Deno

References · 16

• 🔥 https://github.com/denoland/deno/security/advisories/GHSA-2x3r-hwv5-p32x · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24015.json · Exploit
• https://github.com/denoland/deno/commit/4f27d7cdc02e3edfb9d36275341fb8185d6e99ed · Patch
• https://github.com/denoland/deno/commit/0d1beed · Patch
• https://github.com/denoland/deno/commit/a4003a5292bd0affefad3ecb24a8732886900f67 · Patch
• https://osv.dev/vulnerability/CVE-2025-24015 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2x3r-hwv5-p32x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-24015 · Security Note
• https://osv.dev/vulnerability/JLSEC-2026-108 · Vendor Advisory
• https://github.com/denoland/deno · Note
• https://github.com/denoland/deno/commit/0d1beed2e3633d71d5e288e0382b85be361ec13d · Note
• https://twitter.com/VulmonFeeds/status/1930075314450759843 · Twitter Post
• https://t.me/cvenotify/124544 · Telegram Post
• https://twitter.com/CVEnew/status/1930040626260680849 · Twitter Post
• https://t.me/cvetracker/25329 · Telegram Post