{"id":"EUVD-2026-38548","enisaUuid":"386c695f-32a0-34f4-9445-3ab98279f904","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.0.0 until 2.7.8, a flaw in Deno\u0027s Node.js tls compatibility layer could cause a TLS client to transmit application data in plaintext after a connection retry. When `autoSelectFamily was enabled and the first address-family attempt failed, the socket reinitialization path reused a stale TLS upgrade hook that was bound to the original, failed handle. As a result, the replacement TCP connection was never upgraded to TLS, and any data the application wrote before the secureConnect event travelled over the network unencrypted. A network attacker positioned to cause the initial connection attempt to fail (for example, by dropping IPv6 traffic on a dual-stack host) could deterministically trigger the fallback path and observe or tamper with traffic that the application believed was TLS-protected. This vulnerability is fixed in 2.7.8.","datePublished":"Jun 23, 2026, 5:24:02 PM","dateUpdated":"Jun 25, 2026, 1:48:50 PM","baseScore":7.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/denoland/deno/security/advisories/GHSA-chqv-56wv-7564\n","aliases":"CVE-2026-44726\nGHSA-chqv-56wv-7564\n","assigner":"GitHub_M","epss":0.23,"enisaIdProduct":[{"id":"844b922e-0e6f-3970-b67b-8a43a5222063","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"2.0.0, \u003c 2.7.8"}],"enisaIdVendor":[{"id":"b1498abb-bbbc-322d-a92d-639f28abbbcd","vendor":{"name":"denoland"}}],"enisaIdVulnerability":[{"id":"650e9274-9c74-3827-9d55-7688adaf5e16","vulnerability":{"id":"GHSA-chqv-56wv-7564","description":"Deno\u0027s TLS retry copies stale upgrade hook, risking plaintext traffic","datePublished":"May 27, 2026, 7:51:46 PM","dateUpdated":"Jul 20, 2026, 1:42:41 PM","baseScore":0.0,"references":"https://github.com/denoland/deno/security/advisories/GHSA-chqv-56wv-7564\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44726\nhttps://github.com/denoland/deno\n","enisa_id":"EUVD-2026-38548\n","aliases":"CVE-2026-44726\nGHSA-chqv-56wv-7564\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:03 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b749613e-dd94-370d-a8f1-1e588591363c","vulnerability":{"id":"CVE-2026-44726","description":"Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.0.0 until 2.7.8, a flaw in Deno\u0027s Node.js tls compatibility layer could cause a TLS client to transmit application data in plaintext after a connection retry. When `autoSelectFamily was enabled and the first address-family attempt failed, the socket reinitialization path reused a stale TLS upgrade hook that was bound to the original, failed handle. As a result, the replacement TCP connection was never upgraded to TLS, and any data the application wrote before the secureConnect event travelled over the network unencrypted. A network attacker positioned to cause the initial connection attempt to fail (for example, by dropping IPv6 traffic on a dual-stack host) could deterministically trigger the fallback path and observe or tamper with traffic that the application believed was TLS-protected. This vulnerability is fixed in 2.7.8.","datePublished":"Jun 23, 2026, 5:24:02 PM","dateUpdated":"Jun 25, 2026, 1:48:50 PM","status":"PUBLISHED","baseScore":7.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/denoland/deno/security/advisories/GHSA-chqv-56wv-7564\n","enisa_id":"EUVD-2026-38548\n","assigner":"GitHub_M","epss":0.23,"dataProcessed":"Nov 3, 2026, 7:17:56 AM","vulnerabilityProduct":[{"id":"97999199-1ed8-39b1-a10b-4db393957602","product":{"name":"deno","vendor":{"name":"denoland"}},"product_version":"2.0.0, \u003c 2.7.8"}],"vulnerabilityVendor":[{"id":"bf1b505a-f28e-318f-a8d2-8ab3e3828027","vendor":{"name":"denoland"}}]}}],"enisaIdAdvisory":[]}