Before the 2.6.0 release, the node:crypto module in Deno fails to finalize cipher operations, permitting an attacker to perform an unlimited number of encryptions. This flaw can enable brute‑force attacks or more sophisticated attempts to discover server secrets, representing a serious threat to confidentiality and potentially leading to denial of service due to uncontrolled resource consumption.

All releases of denoland/deno prior to the 2.6.0 tag are vulnerable because the node:crypto module is included in those versions. The official fix is integrated into the 2.6.0 release, which can be obtained from the Deno GitHub releases page and the associated security advisory.

The CVSS score of 9.2 signifies high severity, but the EPSS score of less than 1% indicates that exploitation likelihood is currently very low. The vulnerability is not listed in CISA's KEV catalog, suggesting no known production exploitation yet. The flaw can be exploited via the node:crypto API; the likely attack vector involves an attacker provoking repeated encryptions through accessible interfaces or untrusted code paths, thereby exhausting resources or enabling brute‑force analysis of cryptographic key material.