TI-2024-18538 Aliases CVE-2024-27935 GHSA-wrqv-pf6j-mqjp

Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination

HIGH 69CWE-488Published 2024-03-06 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.35.1 and prior to version 1.36.3, a vulnerability in Deno's Node.js compatibility runtime allows for cross-session data contamination during simultaneous asynchronous reads from Node.js streams sourced from sockets or files. The issue arises from the re-use of a global buffer (BUF) in stream_wrap.ts used as a performance optimization to limit allocations during these asynchronous read operations. This can lead to data intended for one session being received by another session, potentially resulting in data corruption and unexpected behavior. This affects all users of Deno that use the node.js compatibility layer for network communication or other streams, including packages that may require node.js libraries indirectly. Version 1.36.3 contains a patch for this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00722 54th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed deno (denoland): 1.36.3deno (crates.io): 1.36.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
denoland	deno	1.35.1 to before 1.36.3	1.36.3	Patch available	CNA
—	deno (crates.io)	1.35.1 to before 1.36.3	1.36.3	Patch available	GHSA-wrqv-pf6j-mqjp

deno Vendordenoland Affected 1.35.1 to before 1.36.3 Fixed in 1.36.3 Patch available CNA
deno (crates.io) Vendor— Affected 1.35.1 to before 1.36.3 Fixed in 1.36.3 Patch available GHSA-wrqv-pf6j-mqjp

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:deno:deno::::::::	1.35.1 to before 1.36.3	Vulnerable	denoland

cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:* Versions 1.35.1 to before 1.36.3 Vulnerable ·denoland

Remediation

Fix · CNA deno (denoland) Fixed in 1.36.3
Fix · GHSA-wrqv-pf6j-mqjp deno (crates.io) Fixed in 1.36.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-27935
2026-10-03 Alias added: GHSA-wrqv-pf6j-mqjp

References

Exploit 1

https://github.com/denoland/deno/issues/20188

Patch 1

https://github.com/denoland/deno/commit/3e9fb8aafd9834ebacd27734cea4310caaf794c6

Advisory 2

Other 1

https://github.com/denoland/deno

TI-2026-21627 Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process CVSS 3.1CRITICAL 9.8
TI-2025-17782 Deno's AES GCM authentication tags are not verified CVSS 4.0HIGH 7.7
TI-2024-18537 *const c_void / ExternalPointer unsoundness leading to use-after-free CVSS 3.1HIGH 8.8
TI-2024-18536 Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass CVSS 3.1HIGH 8.8
TI-2023-12990 Deno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralization CVSS 3.1HIGH 8.8
TI-2023-11328 Regular expression denial of service in deno CVSS 3.1HIGH 7.5

See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences