Critical severity · published Mar 23, 2023
CVE-2023-28445
Deno improperly handles resizable ArrayBuffer
9.8
CVSS
1%
EPSS
No
On KEV
Description
Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Resizable ArrayBuffers passed to asynchronous functions that are shrunk during the asynchronous operation could result in an out-of-bound read/write. It is unlikely that this has been exploited in the wild, as the only version affected is Deno 1.32.0. Deno Deploy users are not affected. The problem has been resolved by disabling resizable ArrayBuffers temporarily in Deno 1.32.1. Deno 1.32.2 will re-enable resizable ArrayBuffers with a proper fix. As a workaround, run with `--v8-flags=--no-harmony-rab-gsab` to disable resizable ArrayBuffers.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DE
deno · denoland
= 1.32.0 · source: vendor, NVD
DR
Deno Runtime · Deno
0.102.0 · source: NVD
SV
Serde V8 · Deno
0.87.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-28445
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-28445
Patch
https://github.com/denoland/deno/pull/18395
Patch
https://github.com/denoland/deno/releases/tag/v1.32.1
Mitigation
https://github.com/denoland/deno/security/advisories/GHSA-c25x-cm9x-qqgx
More from deno
10.0
CVE-2022-24783
Sandbox bypass leading to arbitrary code execution in Deno
9.8
CVE-2026-32260
Command Injection via incomplete shell metacharacter blocklist in node:child_process (bypass of CVE-2026-27190 fix)
9.8
CVE-2026-27190
Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process
9.8
CVE-2026-22864
Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass
9.8
CVE-2023-33966
Deno missing "--allow-net" permission check for built-in Node modules