PT-2026-44129 · Crates.Io+3 · Deno
CVSS v3.1
9.1
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Deno versions 2.0.0 through 2.7.7
Description
A flaw in the Node.js tls compatibility layer can cause a TLS client to transmit application data in plaintext after a connection retry. This occurs when the
autoSelectFamily variable is enabled and the initial address-family attempt fails, leading the socket reinitialization path to reuse a stale TLS upgrade hook bound to the original failed handle. Consequently, the replacement TCP connection is not upgraded to TLS, and any data written before the secureConnect event is sent unencrypted. A network attacker capable of causing the first connection attempt to fail, such as by dropping IPv6 traffic on a dual-stack host, can trigger this path to observe or tamper with traffic. This issue affects applications using the node:tls or node:https surfaces with autoSelectFamily enabled that write to the socket before the secureConnect event.Recommendations
Update to version 2.7.8.
As a temporary workaround, avoid writing data to the socket before the
secureConnect event occurs when using node:tls or node:https with autoSelectFamily enabled.Exploit
Fix
Cleartext Transmission of Sensitive Information
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Deno