CVE Intelligence
Analysis AI-assisted

CVE-2026-44726: Deno Node.js TLS Compatibility Layer Cleartext Transmission After Connection Retry (CWE-319)

Deno versions from 2.0.0 before 2.7.8 can send application data without encryption when a TLS client falls back to another address family after a failed first attempt. The flaw is tied to the autoSelectFamily behavior in Deno's Node.js tls compatibility layer and is stated to be fixed in 2.7.8. NVD scores it 9.1 under CVSS 3.1, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-44726 affects the Node.js tls compatibility layer in Deno. When autoSelectFamily is enabled and the first address-family attempt fails, a reconnection path can leave the replacement TCP connection without TLS, so application data written before the secureConnect event may travel unencrypted. The vendor advisory is linked as GHSA-chqv-56wv-7564.

Impact

  • Application data may be sent in cleartext even though the application expects TLS protection.
  • A network position that can cause the initial connection attempt to fail may allow observation or tampering with that traffic, according to the record's description.
  • The NVD vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, which indicates network access, no privileges and no user interaction, with high confidentiality and integrity impact.
  • The CWE classification is CWE-319, Cleartext Transmission of Sensitive Information.

Affected products and versions

  • Product listed as Deno Deno, versions from 2.0.0 up to but not including 2.7.8.
  • The affected condition requires use of the Node.js tls compatibility layer with autoSelectFamily enabled.

Exploitation status

The record shows CISA KEV listing as false, so this CVE is not confirmed as listed in KEV. No confirmed exploitation appears in the sources consulted. The vendor reference is tagged as Exploit in the record, but the record does not describe exploitation activity.

Remediation and mitigation

  • Upgrade Deno to version 2.7.8 or later, as stated in the advisory description.
  • Inventory Deno installations and identify applications that use the Node.js tls compatibility layer.
  • Where upgrading is not immediately possible, teams may consider reviewing whether autoSelectFamily is needed in their configuration. This is an inference from the described trigger and has not been confirmed as a vendor-recommended workaround.

Detection guidance

  • Review asset inventories for Deno versions below 2.7.8 on hosts with dual-stack networking.
  • Monitor for unexpected unencrypted traffic on ports where the application expects TLS, in line with network security policy.
  • Confirm after patching that the runtime version reports 2.7.8 or later.

Limitations of the available information

The record has no CISA ADP or SSVC data and no EPSS score, so exploitation likelihood is unknown from the provided data. The fixes field is empty, although the description states the fix is in 2.7.8. The GitHub score of 7.4 is listed without a vector string in the record. Public proof-of-concept details are not described in the sources.

Frequently asked questions

Which Deno versions are affected by CVE-2026-44726?

The record lists Deno versions from 2.0.0 up to but not including 2.7.8 as affected.

Is there a fixed version?

The description states the flaw is fixed in 2.7.8. The record's fixes field is empty, so the advisory should be checked for details.

Is this vulnerability known to be actively exploited?

The record shows no CISA KEV listing, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.