CVE-2026-44726: CWE-319: Cleartext Transmission of Sensitive Information in denoland deno
Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.0.0 until 2.7.8, a flaw in Deno's Node.js tls compatibility layer could cause a TLS client to transmit application data in plaintext after a connection retry. When `autoSelectFamily was enabled and the first address-family attempt failed, the socket reinitialization path reused a stale TLS upgrade hook that was bound to the original, failed handle. As a result, the replacement TCP connection was never upgraded to TLS, and any data the application wrote before the secureConnect event travelled over the network unencrypted. A network attacker positioned to cause the initial connection attempt to fail (for example, by dropping IPv6 traffic on a dual-stack host) could deterministically trigger the fallback path and observe or tamper with traffic that the application believed was TLS-protected. This vulnerability is fixed in 2.7.8.
AI Analysis
Technical Summary
CVE-2026-44726 affects Deno, a JavaScript, TypeScript, and WebAssembly runtime, in versions >=2.0.0 and <2.7.8. The vulnerability involves the Node.js TLS compatibility layer where, under certain conditions involving autoSelectFamily and connection retries, the TLS upgrade hook is reused incorrectly. This causes the fallback TCP connection to not be upgraded to TLS, leading to cleartext transmission of application data before the secureConnect event. An attacker able to cause the initial connection attempt to fail (e.g., by dropping IPv6 traffic on a dual-stack host) can exploit this to intercept or tamper with data believed to be TLS-protected. The issue is resolved in version 2.7.8.
Potential Impact
The vulnerability allows an attacker positioned on the network to observe or tamper with application data transmitted in cleartext, despite the application's expectation of TLS protection. This compromises confidentiality and integrity of the data transmitted during the fallback connection attempt. There is no impact on availability. The CVSS v3.1 score is 7.4 (High), reflecting network attack vector, high complexity, no privileges required, no user interaction, and high confidentiality and integrity impact.
Mitigation Recommendations
This vulnerability is fixed in Deno version 2.7.8. Users should upgrade to version 2.7.8 or later to remediate this issue. No official patch or temporary fix is indicated beyond upgrading. Until upgrading, users should be aware of the risk when autoSelectFamily is enabled and consider disabling it if feasible. Patch status is not explicitly confirmed in the advisory, but the fix is stated to be in 2.7.8, so upgrading to >=2.7.8 is the recommended remediation.
CVE-2026-44726: CWE-319: Cleartext Transmission of Sensitive Information in denoland deno
Description
Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.0.0 until 2.7.8, a flaw in Deno's Node.js tls compatibility layer could cause a TLS client to transmit application data in plaintext after a connection retry. When `autoSelectFamily was enabled and the first address-family attempt failed, the socket reinitialization path reused a stale TLS upgrade hook that was bound to the original, failed handle. As a result, the replacement TCP connection was never upgraded to TLS, and any data the application wrote before the secureConnect event travelled over the network unencrypted. A network attacker positioned to cause the initial connection attempt to fail (for example, by dropping IPv6 traffic on a dual-stack host) could deterministically trigger the fallback path and observe or tamper with traffic that the application believed was TLS-protected. This vulnerability is fixed in 2.7.8.
CVSS v3.1
Score 7.4high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-44726 affects Deno, a JavaScript, TypeScript, and WebAssembly runtime, in versions >=2.0.0 and <2.7.8. The vulnerability involves the Node.js TLS compatibility layer where, under certain conditions involving autoSelectFamily and connection retries, the TLS upgrade hook is reused incorrectly. This causes the fallback TCP connection to not be upgraded to TLS, leading to cleartext transmission of application data before the secureConnect event. An attacker able to cause the initial connection attempt to fail (e.g., by dropping IPv6 traffic on a dual-stack host) can exploit this to intercept or tamper with data believed to be TLS-protected. The issue is resolved in version 2.7.8.
Potential Impact
The vulnerability allows an attacker positioned on the network to observe or tamper with application data transmitted in cleartext, despite the application's expectation of TLS protection. This compromises confidentiality and integrity of the data transmitted during the fallback connection attempt. There is no impact on availability. The CVSS v3.1 score is 7.4 (High), reflecting network attack vector, high complexity, no privileges required, no user interaction, and high confidentiality and integrity impact.
Mitigation Recommendations
This vulnerability is fixed in Deno version 2.7.8. Users should upgrade to version 2.7.8 or later to remediate this issue. No official patch or temporary fix is indicated beyond upgrading. Until upgrading, users should be aware of the risk when autoSelectFamily is enabled and consider disabling it if feasible. Patch status is not explicitly confirmed in the advisory, but the fix is stated to be in 2.7.8, so upgrading to >=2.7.8 is the recommended remediation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-07T18:04:17.308Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a3ac4efeed863c81e61822b
Added to database: 06/23/2026, 17:39:59 UTC
Last enriched: 06/30/2026, 23:08:55 UTC
Last updated: 08/06/2026, 00:41:13 UTC
Views: 48
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.