CVE-2026-44726: Deno TLS Downgrade in Node.js Compatibility Layer (2.0.0–2.7.7)

Technical summary

CVE-2026-44726 is a TLS downgrade vulnerability in Deno's Node.js compatibility layer. The root cause is improper socket reinitialization in the fallback path when autoSelectFamily is enabled. When the first address-family attempt fails, the code reuses a stale TLS upgrade hook that references the original failed handle instead of binding to the new replacement socket. This causes the replacement TCP connection to skip TLS negotiation entirely. Data written by the application before the secureConnect event fires is transmitted in cleartext over the network. The vulnerability requires two conditions: autoSelectFamily must be enabled and the initial connection attempt must fail, making it deterministic but not automatic. Attack surface is limited to applications using dual-stack address resolution with this compatibility feature active.

Business impact

Organizations running Deno-based services face potential exposure of sensitive application data—credentials, tokens, session identifiers, or business-critical payloads—in transit, despite the application code assuming encryption. The impact is particularly severe in regulated environments (finance, healthcare, government) where data confidentiality is mandatory. Attackers with network vantage (ISP, router compromise, compromised DNS or BGP) can observe unencrypted traffic or inject malicious content. Reputational and compliance consequences are significant if customer data is compromised. Remediation requires immediate patching; workarounds are limited if autoSelectFamily is necessary for reliability.

Affected systems

Only Deno runtime versions 2.0.0 through 2.7.7 are affected. The vulnerability is specific to Deno's Node.js tls compatibility layer and does not affect other JavaScript runtimes. Exposure is limited to applications that: (1) run on Deno 2.0.0–2.7.7, (2) import or use the Node.js tls module via compatibility, and (3) have autoSelectFamily enabled (either explicitly or by default in their TLS client configuration). Deno 1.x and versions 2.7.8 and later are not vulnerable.

Exploitability

Exploitability is moderate to moderately-high. An attacker must be able to reliably trigger the initial connection attempt to fail, which requires network-level positioning. This is feasible for attackers with control over a router, ISP, or DNS response, or in environments where IPv6 is filtered or unavailable. Once the fallback occurs, the plaintext transmission is deterministic. No user interaction or specific application behavior is required; the flaw is triggered by network conditions alone. Public exploit code availability is not documented, and CVSS Access Complexity is rated High, reflecting the requirement for specific network conditions. However, in dual-stack environments with imperfect IPv6 reachability, the fallback may occur naturally, increasing real-world risk.

Remediation

Upgrade Deno to version 2.7.8 or later. This patch corrects the socket reinitialization path to properly bind the TLS upgrade hook to the replacement connection. Organizations using earlier versions of Deno 2.x must treat this as a critical update. If immediate patching is not possible, temporarily disable autoSelectFamily in TLS client configuration and rely on explicit address-family selection to avoid the fallback path. However, this may reduce connection reliability in dual-stack environments and should only be a temporary measure.

Patch guidance

Patch immediately for all Deno instances running versions 2.0.0–2.7.7. Upgrading to 2.7.8 is a direct, low-risk remediation: the patch is localized to the tls compatibility layer's socket reinitialization logic. Test the upgrade in a staging environment first to confirm any transitive dependencies or build configuration changes. Deno 1.x users require no action. Verify your current Deno version using `deno --version`. If you maintain a pinned version lock or container image, update the Deno image tag and rebuild. Monitor upgrade timelines for any edge cases involving non-standard TLS configurations, though the patch is backward-compatible.

Detection guidance

Detection is challenging without network visibility. Look for: (1) Deno processes running versions 2.0.0–2.7.7 (enumerate via process inspection or inventory management), (2) Use of Node.js tls module in Deno code (grep your application source for `import tls from 'node:tls'` or similar), (3) autoSelectFamily set to true in TLS client options. Network-level detection requires TLS traffic analysis to spot unencrypted payloads on connections that should be encrypted, which is possible with packet capture or network DLP tools if baseline TLS traffic is known. Log analysis for repeated connection failures followed by successful plaintext data transmission may indicate active exploitation. Update your vulnerability scanning to flag Deno 2.0.0–2.7.7 with high priority.

Why prioritize this

HIGH severity. Confidentiality and integrity are both compromised; attackers can observe and modify data believed to be encrypted. CVSS 7.4 reflects the combination of network attack vector and high impact, moderated by the requirement for specific network conditions. The patch is available and requires only a runtime upgrade. Organizations with Deno deployments handling sensitive data should prioritize this as an emergency remediation. Even if autoSelectFamily is not explicitly enabled, the default behavior in some configurations may enable it, warranting an audit.

Risk score, explained

CVSS 3.1 score of 7.4 (HIGH) accounts for: Attack Vector Network (enables remote exploitation), Attack Complexity High (requires specific network conditions to trigger fallback), Privileges Required None, User Interaction None, Scope Unchanged, Confidentiality Impact High (plaintext exposure), Integrity Impact High (data tampering possible), Availability Impact None. The High complexity reflects the need for an attacker to engineer a connection failure, which is non-trivial but achievable in dual-stack environments or with network-level control. The dual-impact on confidentiality and integrity justifies the HIGH rating despite the complexity requirement.

Frequently asked questions