CVE-2026-22863

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.6.0, node:crypto doesn't finalize cipher. The vulnerability allows an attacker to have infinite encryptions. This can lead to naive attempts at brute forcing, as well as more refined attacks with the goal to learn the server secrets. This vulnerability is fixed in 2.6.0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-325

Affected software

Vendor	Product	Versions
denoland	deno	< 2.6.0

References

https://github.com/denoland/deno/releases/tag/v2.6.0Release Notes
https://github.com/denoland/deno/security/advisories/GHSA-5379-f5hf-w38vExploit, Vendor Advisory

Timeline

Published: Jan 15, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-228649.8Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.5.6, a prior patch aimed to block spawning Windows batch/shell files by CVE-2026-228657.4Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When resolving dependencies in versi CVE-2026-228667.5Ethereum Name Service (ENS) is a distributed, open, and extensible naming system based on the Ethereum blockchain. In versions 1.6.2 and pri CVE-2026-228675.4LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 3.8.0 to 4.3.0, a Stored Cross-Site Scripting (XSS) vulner CVE-2026-228687.5go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash us CVE-2026-228699.8Eigent is a multi-agent Workforce. A critical security vulnerability in the CI workflow (.github/workflows/ci.yml) allows arbitrary code exe CVE-2026-22879.8CrewAI does not properly check that Docker is still running during runtime, and will fall back to a sandbox setting that allows for RCE expl CVE-2026-228707.5GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, GuardDog's safe_extract() function does not validate decompresse CVE-2026-228719.8GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, there is a path traversal vulnerability exists in GuardDog's saf CVE-2026-228729.1Capsule is a multi-tenancy and policy-based framework for Kubernetes. The Capsule Controller runs with cluster-admin privileges. Although th CVE-2026-228749.6Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering.CVE-2026-228754.8Movable Type contains a stored cross-site scripting vulnerability in Export Sites. If crafted input is stored by an attacker, arbitrary scri