CVE-2026-44726

{
  "id": "CVE-2026-44726",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-23T18:17:48.623",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.0.0 until 2.7.8, a flaw in Deno's Node.js tls compatibility layer could cause a TLS client to transmit application data in plaintext after a connection retry. When `autoSelectFamily was enabled and the first address-family attempt failed, the socket reinitialization path reused a stale TLS upgrade hook that was bound to the original, failed handle. As a result, the replacement TCP connection was never upgraded to TLS, and any data the application wrote before the secureConnect event travelled over the network unencrypted. A network attacker positioned to cause the initial connection attempt to fail (for example, by dropping IPv6 traffic on a dual-stack host) could deterministically trigger the fallback path and observe or tamper with traffic that the application believed was TLS-protected. This vulnerability is fixed in 2.7.8."
    },
    {
      "lang": "es",
      "value": "Deno es un entorno de ejecución de JavaScript, TypeScript y WebAssembly. Desde 2.0.0 hasta 2.7.8, un fallo en la capa de compatibilidad TLS de Node.js de Deno podría causar que un cliente TLS transmita datos de aplicación en texto plano después de un reintento de conexión. Cuando ’autoSelectFamily’ estaba habilitado y el primer intento de familia de direcciones falló, la ruta de reinicialización del socket reutilizó un ’hook’ de actualización TLS obsoleto que estaba vinculado al ’handle’ original y fallido. Como resultado, la conexión TCP de reemplazo nunca se actualizó a TLS, y cualquier dato que la aplicación escribió antes del evento secureConnect viajó por la red sin cifrar. Un atacante de red posicionado para causar que el intento de conexión inicial fallara (por ejemplo, al descartar tráfico IPv6 en un host de doble pila) podría activar de forma determinista la ruta de respaldo y observar o manipular el tráfico que la aplicación creía que estaba protegido por TLS. Esta vulnerabilidad está corregida en 2.7.8."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "denoland",
          "product": "deno",
          "versions": [
            {
              "version": ">= 2.0.0, < 2.7.8",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.2
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-25T03:55:51.795074Z",
          "id": "CVE-2026-44726",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-319"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.0.0",
              "versionEndExcluding": "2.7.8",
              "matchCriteriaId": "CA8392FC-2247-4255-A9DA-3DC08146AF63"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/denoland/deno/security/advisories/GHSA-chqv-56wv-7564",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}