CVE-2026-49440 json
Deno: Miller-Rabin Primality Test Allows Zero Rounds
published 2026-06-16 4 mo ago modified 2026-10-25 14 d ago also EUVD-2026-38540 , GHSA-9xg4-qhm4-g43w , JLSEC-2026-658
- cvss
- 7.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 14%
- public exploits
- 0
- none known
Summary
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, node:crypto.checkPrime(candidate[, options][, callback]) and crypto.checkPrimeSync(candidate[, options]) ran no Miller-Rabin rounds at all when the caller left options.checks at its default of 0. In that mode, the only test applied to the candidate was trial division by the primes up to 17,863. Any composite whose smallest prime factor exceeds that bound — for example the product of two primes just above it, such as 17,881 × 17,891 — was reported as true ("probably prime"). The same divergence affected the lower-level op_node_check_prime / op_node_check_prime_bytes paths that the polyfill calls into. This vulnerability is fixed in 2.8.1.
Patch / fix
- crates.io deno 2.8.1
- julia Deno_jll 2.8.1+0
- deno deno 2.8.1
- deno deno_runtime 2.8.1
- deno serde_v8 2.8.1
- github.com/denoland/deno#34391 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 4 mo ago
Exploit prediction
0.24% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
| OSV | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | deno | <2.8.1 |
2.8.1 |
| julia | Deno_jll | <2.8.1+0 |
2.8.1+0 |
Affected products
- denoland deno
Classification
- Weakness
-
- CWE-325 Missing Cryptographic Step
References
-
github.com
/denoland/deno/pull/34391
web, issue-tracking
-
github.com
/denoland/deno/security/advisories/GHSA-9xg4-qhm4-g43w
web, third-party-advisory
-
github.com
/denoland/deno
package
-
github.com
/advisories/GHSA-9xg4-qhm4-g43w
web
Sources
- CVE List CVE-2026-49440
- GitHub Advisory GHSA-9xg4-qhm4-g43w
- NVD CVE-2026-49440
- OSV JLSEC-2026-658
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.