← Back to browse · API

CVE-2023-28445

Severity
CRITICAL
CVSS
10.0
EPSS
0.00971
Risk score
40.34
CISA KEV
No
PoC
No
Published
2023-03-23
Modified
2025-02-20
First seen
2026-08-07
Aliases
EUVD-2023-0976, GHSA-C25X-CM9X-QQGX
Products
denoland:deno = 1.32.0
Sources
euvd EUVD-2023-0976

Description

Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Resizable ArrayBuffers passed to asynchronous functions that are shrunk during the asynchronous operation could result in an out-of-bound read/write. It is unlikely that this has been exploited in the wild, as the only version affected is Deno 1.32.0. Deno Deploy users are not affected. The problem has been resolved by disabling resizable ArrayBuffers temporarily in Deno 1.32.1. Deno 1.32.2 will re-enable resizable ArrayBuffers with a proper fix. As a workaround, run with `--v8-flags=--no-harmony-rab-gsab` to disable resizable ArrayBuffers.

References