CVE-2025-24015: Deno AES-GCM Information Disclosure Flaw

CVE-2025-24015 Overview

CVE-2025-24015 is a cryptographic vulnerability in the Deno JavaScript, TypeScript, and WebAssembly runtime. Versions 1.46.0 through 2.1.6 fail to validate the authentication tag when performing AES-256-GCM and AES-128-GCM decryption. Without tag verification, AES-GCM effectively degrades to CTR mode, removing the integrity and authenticity guarantees the algorithm is designed to provide. Tampered ciphertexts, incorrect keys, and modified Additional Authenticated Data (AAD) set through set_aad are accepted silently instead of raising errors. The issue is tracked as [CWE-347: Improper Verification of Cryptographic Signature] and resolved in Deno 2.1.7.

Critical Impact
Applications relying on Deno's AES-GCM for integrity protection can accept forged or tampered ciphertexts without detection, breaking authenticated encryption guarantees.

Affected Products

Deno runtime versions 1.46.0 through 2.1.6
Node.js compatibility layer (ext/node) crypto operations using AES-128-GCM
Node.js compatibility layer (ext/node) crypto operations using AES-256-GCM

Discovery Timeline

2025-06-03 - CVE-2025-24015 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24015

Vulnerability Analysis

The vulnerability resides in Deno's Node.js compatibility layer, specifically in the DecipherIv#final implementation for GCM-mode ciphers. AES-GCM combines CTR-mode encryption with a Galois-field-based authentication tag (GHASH) to provide both confidentiality and integrity. When final() is called on a decipher, the implementation is expected to compare the computed GHASH against the caller-supplied authentication tag and reject any mismatch.

In affected Deno versions, this comparison did not occur. Callers using crypto.createDecipheriv('aes-256-gcm', key, iv) followed by decipher.setAuthTag(tag) and decipher.final() received plaintext output regardless of whether the tag matched. Older Deno releases and Node.js correctly throw an error in this path.

Root Cause

The root cause is missing verification logic in the GCM branch of the decipher final operation. AAD supplied through set_aad is folded into the GHASH computation but the computed hash is never compared to the provided tag. This reduces AES-GCM to raw CTR-mode decryption. Attackers who can modify ciphertext in transit or at rest can flip arbitrary plaintext bits without producing a decryption error.

Attack Vector

Exploitation requires an attacker positioned to tamper with ciphertext, authentication tags, or AAD consumed by a Deno application. Typical scenarios include modifying session tokens, encrypted cookies, encrypted message payloads, or stored records processed through Deno's Node-compatible crypto API. Because CTR mode leaks no error on invalid keys or tampered input, malicious modifications propagate into application logic as valid decrypted data.

rust

// Patch: enforce GCM handling in DecipherIv#final
    auth_tag: &[u8],
  ) -> Result<(), DecipherError> {
    use Decipher::*;

    if input.is_empty() && !matches!(self, Aes128Gcm(_) | Aes256Gcm(_)) {
      return Ok(());
    }

    match (self, auto_pad) {
      (Aes128Cbc(decryptor), true) => {
        assert!(input.len() == 16);

Source: GitHub Deno Commit 4f27d7d

The patch removes the early-return shortcut for empty input on GCM ciphers, forcing the final path to execute the tag verification logic for AES-128-GCM and AES-256-GCM.

Detection Methods for CVE-2025-24015

Indicators of Compromise

Deno runtime binaries reporting versions between 1.46.0 and 2.1.6 in production environments
Application logs showing successful decryption of payloads that other AES-GCM implementations (Node.js, browsers) reject as tag-mismatch errors
Unexpected acceptance of session tokens, JWTs, or encrypted cookies after modification testing

Detection Strategies

Inventory Deno installations across build pipelines, containers, and serverless functions to identify vulnerable versions using deno --version.
Perform differential testing: submit a ciphertext with a corrupted authentication tag to the application and confirm whether a decryption error is raised.
Audit source code for use of crypto.createDecipheriv with aes-128-gcm or aes-256-gcm in Deno-hosted services.

Monitoring Recommendations

Track Deno version telemetry from container images and CI/CD job runners against the fixed baseline of 2.1.7 or later.
Alert on cryptographic errors, or the absence of expected cryptographic errors, in application logs handling authenticated payloads.
Monitor dependency manifests (deno.json, deno.lock) for pinned runtime versions in the affected range.

How to Mitigate CVE-2025-24015

Immediate Actions Required

Upgrade all Deno runtimes to version 2.1.7 or later, which contains the authentication tag verification fix.
Rebuild and redeploy container images, serverless bundles, and edge workers that ship a pinned Deno binary.
Rotate any cryptographic keys used with AES-GCM in the affected runtime, as message integrity cannot be assumed for prior traffic.

Patch Information

The fix is delivered in Deno 2.1.7 through commits 4f27d7d and a4003a5, which restore the GCM authentication tag check inside DecipherIv#final in ext/node/ops/crypto/cipher.rs. Full advisory details are published in GHSA-2x3r-hwv5-p32x.

Workarounds

Where upgrading is not immediately possible, replace AES-GCM operations with an alternative authenticated construction implemented outside ext/node, such as a WebCrypto SubtleCrypto.decrypt call that performs its own tag validation.
Add an explicit HMAC over ciphertext and AAD at the application layer and reject payloads whose HMAC does not verify before invoking Deno's GCM decryption.
Restrict exposure of endpoints that decrypt attacker-controllable ciphertext until the runtime is upgraded.

bash

# Verify installed Deno version and upgrade to the patched release
deno --version
deno upgrade --version 2.1.7
deno --version  # confirm output shows deno 2.1.7 or later