CVE-2026-22863
BaseFortify
Publication date: 2026-01-15
Last updated on: 2026-01-15
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| denoland | deno | 2.6.0 |
| denoland | deno | to 2.6.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-325 | The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the node:crypto module of Deno versions before 2.6.0, where the cipher object created for encryption does not properly finalize when cipher.final() is called. Instead of completing the encryption process, the cipher remains in an incomplete state, allowing an attacker to perform infinite encryptions. This flaw enables both naive brute force attacks and more sophisticated attempts to extract server secrets. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can involve checking the Deno runtime version to identify if it is vulnerable (versions before 2.6.0). Since the vulnerability involves the node:crypto module's cipher not finalizing properly, monitoring for unusual or repeated encryption operations that do not complete may help. However, no specific detection commands are provided in the resources. A practical step is to run `deno --version` to verify the installed version. If it is below 2.6.0, the system is vulnerable. [2]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the Deno runtime to version 2.6.0 or later, where the vulnerability is fixed. This upgrade resolves the issue with the cipher not finalizing encryption properly, preventing infinite encryptions and reducing the risk of brute force or secret extraction attacks. [2]
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of sensitive information by allowing attackers to perform infinite encryptions and attempt to brute force or extract server secrets. It has a high impact on confidentiality but does not affect integrity or availability. The attack can be performed remotely with no privileges or user interaction required. [2]