CVE-2026-22863
📋 TL;DR
Deno's node:crypto module before version 2.6.0 fails to properly finalize cipher operations, allowing attackers to perform infinite encryption attempts. This enables brute-force attacks and potential secret extraction from servers. All Deno applications using node:crypto for encryption are affected.
💻 Affected Systems
- Deno
📦 What is this software?
Deno by Deno
⚠️ Risk & Real-World Impact
Worst Case
Attackers could brute-force encryption keys or extract server secrets, leading to complete compromise of encrypted data and authentication bypass.
Likely Case
Attackers perform targeted brute-force attacks to decrypt sensitive data or extract cryptographic secrets from vulnerable servers.
If Mitigated
With proper rate limiting and monitoring, attacks would be detected and blocked before successful exploitation.
🎯 Exploit Status
Exploitation requires network access to vulnerable Deno applications using node:crypto.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.6.0
Vendor Advisory: https://github.com/denoland/deno/security/advisories/GHSA-5379-f5hf-w38v
Restart Required: Yes
Instructions:
1. Update Deno to version 2.6.0 or later using 'deno upgrade --version 2.6.0'. 2. Restart all Deno applications. 3. Verify the update with 'deno --version'.
🔧 Temporary Workarounds
Disable node:crypto usage
allTemporarily disable or replace node:crypto module usage with alternative encryption libraries.
Modify application code to avoid importing/using node:crypto
🧯 If You Can't Patch
- Implement strict rate limiting on encryption endpoints
- Deploy network-level protections and monitor for unusual encryption request patterns
🔍 How to Verify
Check if Vulnerable:
Check Deno version with 'deno --version'. If version is below 2.6.0 and application uses node:crypto, it is vulnerable.Check Version:
deno --versionVerify Fix Applied:
Run 'deno --version' to confirm version 2.6.0 or higher. Test encryption functionality to ensure it works correctly.📡 Detection & Monitoring
Log Indicators:
- Unusually high volume of encryption requests
- Repeated failed encryption attempts from single sources
Network Indicators:
- High frequency of requests to encryption endpoints
- Patterns of encryption requests with varying inputs
SIEM Query:
source="deno" AND (event="encryption_request" OR event="crypto_operation") | stats count by src_ip, dest_ip | where count > threshold