CVE-2026-49440
CVE-2026-49440 is a high-severity vulnerability in Deno with a CVSS 3.x base score of 7.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-325.
Key facts
- Severity: High (CVSS 3.x base score 7.4)
- EPSS exploit prediction: 0% (5th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-38540
- Weakness: CWE-325
- Affected product: Deno
- Published:
- Last modified:
Description
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, node:crypto.checkPrime(candidate[, options][, callback]) and crypto.checkPrimeSync(candidate[, options]) ran no Miller-Rabin rounds at all when the caller left options.checks at its default of 0. In that mode, the only test applied to the candidate was trial division by the primes up to 17,863. Any composite whose smallest prime factor exceeds that bound — for example the product of two primes just above it, such as 17,881 × 17,891 — was reported as true ("probably prime"). The same divergence affected the lower-level op_node_check_prime / op_node_check_prime_bytes paths that the polyfill calls into. This vulnerability is fixed in 2.8.1.
Frequently asked questions
- What is CVE-2026-49440?
- Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, node:crypto.checkPrime(candidate[, options][, callback]) and crypto.checkPrimeSync(candidate[, options]) ran no Miller-Rabin rounds at all when the caller left options.checks at its default of 0. In that mode, the only test applied to the candidate was trial division by the primes up to 17,863. Any composite whose smallest prime factor exceeds that bound — for example the product of two primes just above it, such as 17,881 × 17,891 — was reported as true ("probably prime"). The same divergence affected the lower-level op_node_check_prime / op_node_check_prime_bytes paths that the polyfill calls into. This vulnerability is fixed in 2.8.1.
- How severe is CVE-2026-49440?
- CVE-2026-49440 has a CVSS 3.x base score of 7.4, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
- Is CVE-2026-49440 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (5th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-49440?
- CVE-2026-49440 affects Deno. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2026-49440?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2026-49440 have an EU (EUVD) identifier?
- Yes. CVE-2026-49440 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-38540.
- When was CVE-2026-49440 published?
- CVE-2026-49440 was published on 2026-06-23 and last updated on 2026-06-26.
References
- https://github.com/denoland/deno/pull/34391
- https://github.com/denoland/deno/security/advisories/GHSA-9xg4-qhm4-g43w
Affected products (1)
- cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*
More vulnerabilities in Deno
- CVE-2022-24783 — Critical (CVSS 10.0): Deno is a runtime for JavaScript and TypeScript. The versions of Deno between release 1.18.0 and 1.20.2 (inclusive) are…
- CVE-2023-28445 — Critical (CVSS 9.9): Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Resizable ArrayBuffers passed to…
- CVE-2021-32619 — Critical (CVSS 9.8): Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. In Deno versions 1.5.0 to 1.10.1,…
- CVE-2025-48935 — Critical (CVSS 9.1): Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 2.2.0 and prior to versions 2.2.5, it is…
- CVE-2024-27936 — High (CVSS 8.8): Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Starting in version 1.32.1 and prior to…
- CVE-2023-28446 — High (CVSS 8.8): Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Arbitrary…
Other CWE-325 vulnerabilities
- CVE-2026-4601 — High (CVSS 8.7): Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the…
- CVE-2025-30147 — High (CVSS 8.7): Besu Native contains scripts and tooling that is used to build and package the native libraries used by the Ethereum…
- CVE-2026-45445 — High (CVSS 7.5): Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the…
- CVE-2026-41395 — High (CVSS 7.5): OpenClaw before 2026.3.28 contains a webhook replay vulnerability in Plivo V3 signature verification that canonicalizes…
- CVE-2026-22863 — High (CVSS 7.5): Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.6.0, node:crypto doesn't finalize cipher. The…
- CVE-2025-60704 — High (CVSS 7.5): Missing cryptographic step in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.