CVE-2026-44726

Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.0.0 until 2.7.8, a flaw in Deno's Node.js tls compatibility layer could cause a TLS client to transmit application data in plaintext after a connection retry. When `autoSelectFamily was enabled and the first address-family attempt failed, the socket reinitialization path reused a stale TLS upgrade hook that was bound to the original, failed handle. As a result, the replacement TCP connection was never upgraded to TLS, and any data the application wrote before the secureConnect event travelled over the network unencrypted. A network attacker positioned to cause the initial connection attempt to fail (for example, by dropping IPv6 traffic on a dual-stack host) could deterministically trigger the fallback path and observe or tamper with traffic that the application believed was TLS-protected. This vulnerability is fixed in 2.7.8.

• CWE-319

• https://github.com/denoland/deno/security/advisories/GHSA-chqv-56wv-7564Exploit, Vendor Advisory

Published

Jun 23, 2026

Last Modified

Jun 26, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4472A security vulnerability has been detected in itsourcecode O…9.8
• CVE-2026-44720OpenLearnX is an open-source, decentralized learning and ass…6.9
• CVE-2026-44721Open WebUI is a self-hosted artificial intelligence platform…7.3
• CVE-2026-44722pyzipper is a replacement for Python's zipfile that can read…6.2
• CVE-2026-44723Vowpal Wabbit is a machine learning system. The workflow .gi…9.9
• CVE-2026-44724systeminformation is a System and OS information library for…7.8
• CVE-2026-44727Jupyter Server is the backend for Jupyter web applications. …5.4
• CVE-2026-44728Babel is a compiler for writing next generation JavaScript. …7.8
• CVE-2026-44729Twenty is an open source CRM. In 1.18.0 and earlier, the fil…8.7
• CVE-2026-4473A vulnerability was detected in itsourcecode Online Doctor A…9.8
• CVE-2026-44730OpenCTI is an open source platform for managing cyber threat…7.2
• CVE-2026-44731OpenProject is open-source, web-based project management sof…4.3