Alerts

Critical Deno Vulnerabilities Enable Server Secrets Exposure and Windows Command Injection

Zero Day Wire

— 1 min read
Share
Critical Deno Vulnerabilities Enable Server Secrets Exposure and Windows Command Injection

Two significant security vulnerabilities have been discovered in Deno, the modern JavaScript and TypeScript runtime known for its "secure by default" architecture.

The flaws could expose sensitive server secrets and allow command injection on Windows systems.

Vulnerabilities

CVE IDCVSS ScoreTypeImpact
CVE-2026-228639.2 (Critical)Missing Cryptographic StepSecrets exposure
CVE-2026-22864HighCommand InjectionArbitrary code execution on Windows

CVE-2026-22863 - Cryptographic Flaw

The more severe vulnerability resides in Deno's node:crypto compatibility layer - a module that allows Deno to run code originally written for Node.js.

The flaw involves the cipher not being properly finalized, which allows attackers to perform infinite encryptions. This can lead to brute force attacks or more refined attacks aimed at learning server secrets.

Affected versions: Deno 2.5.6 and earlier

CVE-2026-22864 - Windows Command Injection

The second vulnerability is an incomplete fix for command injection prevention on Windows. The flaw allows case-insensitive extension bypass, potentially enabling arbitrary command execution on vulnerable Windows systems.

Remediation

All users should upgrade to Deno v2.6.0 or newer immediately.

Why This Matters

Deno markets itself as "secure by default" - a runtime designed to address Node.js security shortcomings. These vulnerabilities undermine that promise, particularly for:

  • Applications using the Node.js compatibility layer
  • Production deployments on Windows
  • Services handling sensitive cryptographic operations

Organizations running Deno in production should prioritize this update.

Read more

Nx Console VS Code Extension Compromised — 2.2 Million Installs Exposed to Credential Stealer With Sigstore Supply Chain Poisoning Capability

Nx Console VS Code Extension Compromised — 2.2 Million Installs Exposed to Credential Stealer With Sigstore Supply Chain Poisoning Capability

A compromised version of the Nx Console extension — a popular VS Code plugin with over 2.2 million installations — was published to the Visual Studio Code Marketplace after an attacker leveraged stolen developer credentials to inject a multi-stage credential stealer into the official nrwl/nx GitHub repository. The malicious version

By Zero Day Wire
Pre-Stuxnet Sabotage Malware Fast16 Confirmed as Nuclear Weapons Simulation Tampering Tool Dating Back to 2005

Pre-Stuxnet Sabotage Malware Fast16 Confirmed as Nuclear Weapons Simulation Tampering Tool Dating Back to 2005

Symantec and Carbon Black have published a definitive analysis confirming that Fast16, a Lua-based malware framework first surfaced by SentinelOne weeks ago, was purpose-built to sabotage nuclear weapons testing simulations. The findings establish Fast16 as the earliest known cyber sabotage tool targeting nuclear weapons research — predating the first known version

By Zero Day Wire