github.com
https://github.com/denoland/deno CVE-2023-28445
CRITICAL
Deno improperly handles resizable ArrayBuffer
Record summary
CVE-2023-28445 has a selected CVSS score of 10.0 (critical).
Description
Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Resizable ArrayBuffers passed to asynchronous functions that are shrunk during the asynchronous operation could result in an out-of-bound read/write. It is unlikely that this has been exploited in the wild, as the only version affected is Deno 1.32.0. Deno Deploy users are not affected. The problem has been resolved by disabling resizable ArrayBuffers temporarily in Deno 1.32.1. Deno 1.32.2 will re-enable resizable ArrayBuffers with a proper fix. As a workaround, run with `--v8-flags=--no-harmony-rab-gsab` to disable resizable ArrayBuffers.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 20, 2025 · Source: CVE List
Affected products and versions
4| Product | Source | Version range | Status |
|---|---|---|---|
| CVE List | = 1.32.0 | affected | |
| GitHub Advisory | 1.32.0 | affected | |
| 1.32.0 to < 1.32.1 · Fixed in 1.32.1 | affected | ||
deno_runtimeBrowse crates.io / deno_runtime | GitHub Advisory | 0.102.0 | affected |
| 0.102.0 to < 0.103.0 · Fixed in 0.103.0 | affected | ||
serde_v8Browse crates.io / serde_v8 | GitHub Advisory | 0.87.0 | affected |
| 0.87.0 to < 0.88.0 · Fixed in 0.88.0 | affected |
References
6github.com
https://github.com/denoland/deno/pull/18395 github.com
https://github.com/denoland/deno/pull/18452 github.com
https://github.com/denoland/deno/releases/tag/v1.32.1 github.comConfirmation
https://github.com/denoland/deno/security/advisories/GHSA-c25x-cm9x-qqgx nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2023-28445