CVE-2026-22863— Deno node:crypto doesn't finalize cipher
Quick assessment
Affected
denoland deno
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Deno是Deno开源的一个简单、现代且安全的 JavaScript 和 TypeScript 运行环境。 Deno 2.6.0之前版本存在安全漏洞，该漏洞源于node:crypto未完成密码加密，可能导致无限加密攻击。
Possible ATT&CK Techniques 1 AI
T1552.001 · Credentials In Files
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-22863
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Deno node:crypto doesn't finalize cipher
Source: CVE Program / CVE List V5
Vulnerability Description
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.6.0, node:crypto doesn't finalize cipher. The vulnerability allows an attacker to have infinite encryptions. This can lead to naive attempts at brute forcing, as well as more refined attacks with the goal to learn the server secrets. This vulnerability is fixed in 2.6.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
缺少必要的密码学步骤
Source: CVE Program / CVE List V5
Vulnerability Title
Deno 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Deno是Deno开源的一个简单、现代且安全的 JavaScript 和 TypeScript 运行环境。 Deno 2.6.0之前版本存在安全漏洞，该漏洞源于node:crypto未完成密码加密，可能导致无限加密攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-22863
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-22863
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: deno
-
CVE-2026-55517
Deno: Denial of service via non-ASCII bytes in WebSocket res -
CVE-2026-44726
Deno: TLS retry copies stale upgrade hook, risking plaintext -
CVE-2026-49401
Deno Permission Bypass via Unicode Normalization Mismatch on -
CVE-2026-49402
Deno: Command Injection via spawnSync & spawn on Windows -
CVE-2026-49406
Deno: BYONM module resolution allows `package.json` main pat
Same vendor: denoland
-
CVE-2026-55517
Deno: Denial of service via non-ASCII bytes in WebSocket res -
CVE-2026-44726
Deno: TLS retry copies stale upgrade hook, risking plaintext -
CVE-2026-49401
Deno Permission Bypass via Unicode Normalization Mismatch on -
CVE-2026-49402
Deno: Command Injection via spawnSync & spawn on Windows -
CVE-2026-49406
Deno: BYONM module resolution allows `package.json` main pat
Same weakness: CWE-325
-
CVE-2026-81235
Dell Wyse Management Suite 2605.0.3.683前版本密码学缺陷 -
CVE-2026-25250
Microsoft Windows Secure Boot 安全漏洞 -
CVE-2026-76784
Insufficient Cryptographic Protections in Local Device Commu -
CVE-2026-59776
Sony FeliCa IC chips 加密问题漏洞 -
CVE-2026-58638
Windows Boot Loader Security Feature Bypass Vulnerability
V. Comments for CVE-2026-22863
No comments yet