CVE-2026-44726 is a high severity cleartext transmission flaw (CVSS 7.4) in the Node compatibility TLS layer of Deno, from 2.0.0 up to 2.7.7. After a connection retry, a client could send data without TLS. Upgrade Deno to 2.7.8 or later and review any code that writes early.
What's affected
From the project advisory:
- Affected: Deno 2.0.0 up to, but not including, 2.7.8.
- Fixed: 2.7.8.
The advisory says the affected APIs are node:tls and node:https when autoSelectFamily is enabled, which is the default, and when the application wrote to the socket before the secureConnect event. Code that uses the native Deno fetch and TLS APIs rather than the Node compatibility layer is not described in the advisory as affected.
How to check if you're exposed
Check the runtime version on each machine and in each image:
deno --version
Then search your code and dependencies for Node style TLS use, for example:
grep -rn "node:tls\|node:https\|autoSelectFamily" --include="*.ts" --include="*.js" --include="*.mjs" .
Prioritize dual stack hosts, where an IPv6 attempt might fail and the client falls back.
What to do now
- Upgrade Deno to 2.7.8 or later in every environment, including CI and container images.
- Review code that writes to a TLS socket before the secure connect event, and wait for that event first. Do this as hardening, not as a substitute for the upgrade.
- Consider which secrets or tokens a client might have sent on affected connections, and rotate those where the network path is not trusted.
- Prefer higher level clients that handle secure connection setup, such as the platform fetch.
Why it matters
The class is CWE-319 (cleartext transmission of sensitive information). On a retry, the code reused a stale upgrade hook tied to the failed first connection, so the replacement connection never switched to TLS. Anything written before the secure connection event went out in the clear.
The attack is not a break of TLS itself. A network attacker who can cause the first attempt to fail, for instance by dropping IPv6 traffic on a dual stack host, can force the fallback path. That is why the complexity in the CVSS vector is high but the impact on confidentiality and integrity is also high.
The record does not mark this CVE as KEV. The bug is a reminder that retry paths need their own tests for security properties.
Quick check
Does this affect the standard Deno fetch API?
The advisory describes the Node compatibility TLS layer. It does not list fetch as affected.
Sources
Last reviewed: 19 October 2026.
