CVE-2026-22863

The error classified as CWE-325 (Missing Required Cryptographic Step) consists in the fact that the node:crypto module in Deno does not perform the required cipher finalization step. Missing finalization means that the internal state of the cipher is not properly reset or terminated after the encryption operation. An attacker can exploit this to perform an unlimited number of encryption operations within the same session, which facilitates both naive brute-force attacks and more advanced analytical attacks aimed at recovering server secrets.

Remote attacker without authentication can gain access to sensitive information, including potentially cryptographic secrets stored on the server side (high confidentiality impact on system context — SC:H). Integrity and availability of resources are not directly threatened.

Update Deno to version 2.6.0 or later, where the vulnerability has been fixed. Patch details available in official release information: https://github.com/denoland/deno/releases/tag/v2.6.0

Deno in versions before 2.6.0 — all applications using the node:crypto module in this environment.