TI-2023-12989 Aliases CVE-2023-28445 GHSA-c25x-cm9x-qqgx

Deno improperly handles resizable ArrayBuffer

MEDIUM 45CWE-125Published 2023-03-23 · Updated 2025-02-20

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-787 and the CVSS impact.

Summary

Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Resizable ArrayBuffers passed to asynchronous functions that are shrunk during the asynchronous operation could result in an out-of-bound read/write. It is unlikely that this has been exploited in the wild, as the only version affected is Deno 1.32.0. Deno Deploy users are not affected. The problem has been resolved by disabling resizable ArrayBuffers temporarily in Deno 1.32.1. Deno 1.32.2 will re-enable resizable ArrayBuffers with a proper fix. As a workaround, run with `--v8-flags=--no-harmony-rab-gsab` to disable resizable ArrayBuffers.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00971 62nd percentileScored 2026-11-07

Fix Fixed Deno (crates.io): 1.32.1serde_v8 (crates.io): 0.88.0+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
denoland	deno	= 1.32.0	—	No fix listed	CNA
—	Deno (crates.io)	1.32.0 to before 1.32.1	1.32.1	Patch available	GHSA-c25x-cm9x-qqgx
—	serde_v8 (crates.io)	0.87.0 to before 0.88.0	0.88.0	Patch available	GHSA-c25x-cm9x-qqgx
—	deno_runtime (crates.io)	0.102.0 to before 0.103.0	0.103.0	Patch available	GHSA-c25x-cm9x-qqgx

deno Vendordenoland Affected = 1.32.0 Fixed in — No fix listed CNA
Deno (crates.io) Vendor— Affected 1.32.0 to before 1.32.1 Fixed in 1.32.1 Patch available GHSA-c25x-cm9x-qqgx
serde_v8 (crates.io) Vendor— Affected 0.87.0 to before 0.88.0 Fixed in 0.88.0 Patch available GHSA-c25x-cm9x-qqgx
deno_runtime (crates.io) Vendor— Affected 0.102.0 to before 0.103.0 Fixed in 0.103.0 Patch available GHSA-c25x-cm9x-qqgx

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:deno:deno:1.32.0:::::::*	1.32.0	Vulnerable	denoland
cpe:2.3:a:deno:deno_runtime:0.102.0:::::rust::	0.102.0	Vulnerable	denoland
cpe:2.3:a:deno:serde_v8:0.87.0:::::rust::	0.87.0	Vulnerable	denoland

cpe:2.3:a:deno:deno:1.32.0:*:*:*:*:*:*:* Versions 1.32.0 Vulnerable ·denoland
cpe:2.3:a:deno:deno_runtime:0.102.0:*:*:*:*:rust:*:* Versions 0.102.0 Vulnerable ·denoland
cpe:2.3:a:deno:serde_v8:0.87.0:*:*:*:*:rust:*:* Versions 0.87.0 Vulnerable ·denoland

Remediation

Fix · GHSA-c25x-cm9x-qqgx Deno (crates.io) Fixed in 1.32.1 Advisory →
Fix · GHSA-c25x-cm9x-qqgx serde_v8 (crates.io) Fixed in 0.88.0 Advisory →
Fix · GHSA-c25x-cm9x-qqgx deno_runtime (crates.io) Fixed in 0.103.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-28445
2026-10-03 Alias added: GHSA-c25x-cm9x-qqgx

References

Patch 2

Advisory 2

Other 2

TI-2026-21627 Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process CVSS 3.1CRITICAL 9.8
TI-2025-17782 Deno's AES GCM authentication tags are not verified CVSS 4.0HIGH 7.7
TI-2024-18537 *const c_void / ExternalPointer unsoundness leading to use-after-free CVSS 3.1HIGH 8.8
TI-2024-18536 Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass CVSS 3.1HIGH 8.8
TI-2023-12990 Deno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralization CVSS 3.1HIGH 8.8
TI-2023-11328 Regular expression denial of service in deno CVSS 3.1HIGH 7.5

See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences