CVE-2023-28445: Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Resizable ArrayBuffers passed to asynchronous functions that are shrunk…

PriorityP346critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

ITW

Exploited in the wild

EPSS

0.97%

60.4th percentile

Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Resizable ArrayBuffers passed to asynchronous functions that are shrunk during the asynchronous operation could result in an out-of-bound read/write. It is unlikely that this has been exploited in the wild, as the only version affected is Deno 1.32.0. Deno Deploy users are not affected. The problem has been resolved by disabling resizable ArrayBuffers temporarily in Deno 1.32.1. Deno 1.32.2 will re-enable resizable ArrayBuffers with a proper fix. As a workaround, run with `--v8-flags=--no-harmony-rab-gsab` to disable resizable ArrayBuffers.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
deno	deno	—	—
deno	deno	>= 1.32.0 < 1.32.1	1.32.1
deno	deno_runtime	—	—
deno	deno_runtime	>= 0.102.0 < 0.103.0	0.103.0
deno	serde_v8	—	—
deno	serde_v8	>= 0.87.0 < 0.88.0	0.88.0
denoland	deno	—	—

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.