PT-2026-3145 · Deno · Deno

Davidebombelli + 2 · Published 2026-01-15 · Updated 2026-04-14 · CVE-2026-22863

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Deno versions prior to 2.6.0

Description Deno is a JavaScript, TypeScript, and WebAssembly runtime. A flaw in the node:crypto polyfill allows cryptographic handles to persist beyond their intended lifespan. This results in the possibility of infinite encryption rounds, potentially enabling attackers to attempt brute-force attacks or learn server secrets. The issue stems from the node:crypto module not finalizing ciphers correctly.

Recommendations Upgrade to Deno version 2.6.0 or newer.

Exploit

Fix

Weakness Enumeration

CWE-325

Related Identifiers

BDU:2026-00636

CVE-2026-22863

GHSA-5379-F5HF-W38V

JLSEC-2026-114

Affected Products

Deno

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22863.json · Exploit
• https://github.com/denoland/deno/security/advisories/GHSA-5379-f5hf-w38v · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00636 · Security Note
• https://osv.dev/vulnerability/JLSEC-2026-114 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-22863 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22863 · Security Note
• https://osv.dev/vulnerability/GHSA-5379-f5hf-w38v · Vendor Advisory
• https://github.com/denoland/deno/releases/tag/v2.6.0 · Note
• https://github.com/denoland/deno · Note
• https://twitter.com/Komodosec/status/2026435621481492988 · Twitter Post
• https://twitter.com/Karma_X_Inc/status/2013054963954372680 · Twitter Post
• https://twitter.com/0dayPublishing/status/2011939221460709413 · Twitter Post
• https://twitter.com/CVEnew/status/2012126518009352272 · Twitter Post
• https://github.com/advisories/GHSA-5379-f5hf-w38v · Note
• https://t.me/cveNotify/149388 · Telegram Post