Executive brief
Deno is a software runtime used to build and run JavaScript and TypeScript applications. A security flaw in its Node.js compatibility layer could cause encrypted connections to fail silently and send data in plain text over the network. An attacker who can interfere with a user's initial connection attempt could intercept or modify sensitive information, such as login credentials or financial data, that the application intended to protect with encryption.
Technical details
A vulnerability exists in Deno's Node.js 'tls' compatibility layer (specifically affecting node:tls and node:https) when 'autoSelectFamily' is enabled. When an initial connection attempt fails (e.g., an IPv6 timeout), the socket reinitialization path reuses a stale TLS upgrade hook bound to the original failed handle. Consequently, the fallback TCP connection (e.g., IPv4) is never upgraded to TLS. Any data written by the application before the 'secureConnect' event is transmitted as plaintext. A network-positioned attacker can trigger this by dropping packets to force a connection retry, allowing them to intercept or tamper with traffic. The issue is fixed in Deno version 2.7.8.
Affected products
- denoland Deno >= 2.0.0, < 2.7.8
Timeline
- 2026-05-27: advisory: GitHub advisory GHSA-chqv-56wv-7564 published
- 2026-06-23: disclosed: CVE-2026-44726 published to NVD
- 2026-06-23: patched: Vulnerability fixed in version 2.7.8