CVE-2026-49440 Details
Description
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, node:crypto.checkPrime(candidate[, options][, callback]) and crypto.checkPrimeSync(candidate[, options]) ran no Miller-Rabin rounds at all when the caller left options.checks at its default of 0. In that mode, the only test applied to the candidate was trial division by the primes up to 17,863. Any composite whose smallest prime factor exceeds that bound — for example the product of two primes just above it, such as 17,881 × 17,891 — was reported as true ("probably prime"). The same divergence affected the lower-level op_node_check_prime / op_node_check_prime_bytes paths that the polyfill calls into. This vulnerability is fixed in 2.8.1.
A vulnerability in Deno's crypto module prior to version 2.8.1 allows composite numbers to be incorrectly identified as prime. This issue arises in the `node:crypto.checkPrime` and `crypto.checkPrimeSync` functions when the `options.checks` parameter is left at its default value of 0`. In this case, the functions only perform trial division by primes up to 17,863. As a result, any composite number with a smallest prime factor above this limit, such as the product of two primes just over it, can be falsely reported as 'probably prime'. The vulnerability also affects lower-level functions that the polyfill utilizes.
Users can upgrade to Deno version 2.8.1 or later, where this vulnerability is fixed. If an immediate upgrade is not possible, an explicit `checks` value can be passed to the `crypto.checkPrime` or `crypto.checkPrimeSync` functions. A `checks` value of 64 is recommended for any reasonable bit length.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/denoland/deno/pull/34391 | [email protected] | Issue Tracking |
| https://github.com/denoland/deno/security/advisories/GHSA-9xg4-qhm4-g43w | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-325 | Missing Cryptographic Step | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| deno deno | < 2.8.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | New CVE Received | [email protected] |