9.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22863

CVE-2026-22863: Deno node:crypto doesn't finalize cipher

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.6.0, node:crypto doesn't finalize cipher. The vulnerability allows an attacker to have infinite encryptions. This can lead to naive attempts at brute forcing, as well as more refined attacks with the goal to learn the server secrets. This vulnerability is fixed in 2.6.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22863

CVE-2026-22863:

9.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
deno	rust	<= 2.5.6	2.6.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows an attacker to perform infinite encryptions because the cipher object in Deno's implementation of the node:crypto module was not being properly finalized. The analysis of the patch that fixes this vulnerability confirms this. The commit 0bc213b15b819597d935be6cb04cec03659d146b introduces a state-tracking mechanism to the Cipheriv and Decipheriv classes in ext/node/polyfills/internal/crypto/cipher.ts.

A new private field #finalized is added to both classes. This flag is set to true within the final() method of each class. Subsequently, both the update() and final() methods are modified to check the state of this #finalized flag at the beginning of their execution. If the flag is true, indicating that the cipher/decipher has already been finalized, the methods now throw an ERR_CRYPTO_INVALID_STATE error, preventing any further operations.

The vulnerable functions are the update and final methods of the Cipheriv and Decipheriv classes, as they were the ones that lacked the necessary state check, allowing them to be called on an already finalized object, which is the root cause of the vulnerability.

Vulnerable functions

Cipheriv.final

ext/node/polyfills/internal/crypto/cipher.ts

The `final` method of the `Cipheriv` class did not prevent subsequent calls after the cipher was finalized. This allowed for multiple finalizations of the same cipher instance, which is the core of the vulnerability. The patch adds a check to ensure `final` can only be called once.

Cipheriv.update

ext/node/polyfills/internal/crypto/cipher.ts

The `update` method of the `Cipheriv` class could be called even after the cipher was finalized by a call to `final()`. This allowed for data to be processed by a finalized cipher, leading to unexpected behavior and potential cryptographic weaknesses. The patch prevents this by adding a state check.

Decipheriv.final

ext/node/polyfills/internal/crypto/cipher.ts

Similar to `Cipheriv.final`, the `final` method of the `Decipheriv` class did not prevent subsequent calls after the decipher was finalized. The patch adds a check to ensure `final` can only be called once.

Decipheriv.update

ext/node/polyfills/internal/crypto/cipher.ts

Similar to `Cipheriv.update`, the `update` method of the `Decipheriv` class could be called after the decipher was finalized. The patch prevents this by adding a state check.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.