CVE-2026-22863
High · 8.6Deno node:crypto doesn't finalize cipher
CVSS
8.6
EPSS
0.2%
Published
Jan 16, 2026
CISA due date
—
The record
The vulnerability allows an attacker to have infinite encryptions. This can lead to naive attempts at brute forcing, as well as more refined attacks with the goal to learn the server secrets.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | deno | 0 | 2.6.0 |
Related vulnerabilities
- GHSA-5379-f5hf-w38v Deno node:crypto doesn't finalize cipher Same vulnerability
- CVE-2026-55517 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Also affects deno
- CVE-2026-49860 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Also affects deno
- CVE-2026-49983 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Also affects deno
- CVE-2026-49401 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Also affects deno
- CVE-2026-49411 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Also affects deno
- CVE-2026-49402 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Also affects deno
- CVE-2026-49440 Deno is a JavaScript, TypeScript, and WebAssembly runtime. Also affects deno