Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2026-22863

Good to know:

icon
icon

Date: January 15, 2026

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.6.0, node:crypto doesn't finalize cipher. The vulnerability allows an attacker to have infinite encryptions. This can lead to naive attempts at brute forcing, as well as more refined attacks with the goal to learn the server secrets. This vulnerability is fixed in 2.6.0.

Severity Score

Related Resources (5)

https://github.com/denoland/deno
https://github.com/denoland/deno/security/advisories/GHSA-5379-f5hf-w38v
https://github.com/denoland/deno/releases/tag/v2.6.0
https://nvd.nist.gov/vuln/detail/CVE-2026-22863
https://www.mend.io/vulnerability-database/CVE-2026-22863

Severity Score

Weakness Type (CWE)

Missing Cryptographic Step

CWE-325

Top Fix

icon

Upgrade Version

Upgrade to version deno - 2.6.0;https://github.com/denoland/deno.git - v2.6.0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): CHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us