Deno: TLS retry copies stale upgrade hook, risking plaintext traffic (CVE-2026-44726) | HOL Guard CVE

High · CVSS 7.4CVE-2026-44726

Deno: TLS retry copies stale upgrade hook, risking plaintext traffic

Answer in brief

CVE-2026-44726 records a High severity (CVSS 7.4) vulnerability in Deno: TLS retry copies stale upgrade hook, risking plaintext traffic. The current sources do not mark it as known exploited. The current feed maps denoland/deno (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Jun 23, 2026Updated Jun 26, 2026Source checked Sep 19, 2026First seen by HOL Jun 23, 2026Material review Jun 26, 2026

Upstream Advisory

Key facts

Risk: High · CVSS 7.4
Exploitation: Not marked as known exploited
Affected software: 1 mapped package or product
Fix availability: Not reported

Why this deserves its current priority

CVSS is 7.4. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps denoland/deno (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
denoland/denogeneric	>= 2.0.0, < 2.7.8	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for denoland/deno.
Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

Published upstream
Jun 23, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Jun 26, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Jun 23, 2026

Sources and claim methodology

GitHub security advisorygithub.com

Upstream source description

Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.0.0 until 2.7.8, a flaw in Deno's Node.js tls compatibility layer could cause a TLS client to transmit application data in plaintext after a connection retry. When `autoSelectFamily was enabled and the first address-family attempt failed, the socket reinitialization path reused a stale TLS upgrade hook that was bound to the original, failed handle. As a result, the replacement TCP connection was never upgraded to TLS, and any data the application wrote before the secureConnect event travelled over the network unencrypted. A network attacker positioned to cause the initial connection attempt to fail (for example, by dropping IPv6 traffic on a dual-stack host) could deterministically trigger the fallback path and observe or tamper with traffic that the application believed was TLS-protected. This vulnerability is fixed in 2.7.8.

Quoted source text, attributed separately from HOL analysis.