Critical Deno Flaws Risk Secrets (CVE-2026-22863) & Execution (CVE-2026-22864)

Deno, the modern JavaScript and TypeScript runtime, has two significant security flaws: CVE-2026-22863 and CVE-2026-22864, both described as critical and capable of exposing server secrets or enabling arbitrary code execution. CVE-2026-22863 affects Deno’s node:crypto compatibility layer, with a CVSS score of 9.2, where the final() method can leave the cipher open, potentially enabling brute force attempts and other attacks to learn server secrets.

The second issue, CVE-2026-22864, targets Windows subprocess spawning via Deno[.]Command, where a bypass of patched restrictions allows batch files to execute, including an example that runs calc.exe through argument injection. The article notes a PoC showing a script successfully exploiting a batch file context, achieving arbitrary code execution on the host machine. Users are urged to upgrade to Deno v2.6.0 or newer immediately to close these flaws, as outlined in the advisory.