UpHeron
All vulnerabilities

Servers and applications

CVE-2023-28445

Improper handling of resizable ArrayBuffer in async built-in functions

Severity
Critical 9.8
Published
23 Mar 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Also known as
GHSA-c25x-cm9x-qqgx
Sources
NVD, Project advisories (GitHub)

Description

Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Resizable ArrayBuffers passed to asynchronous functions that are shrunk during the asynchronous operation could result in an out-of-bound read/write. It is unlikely that this has been exploited in the wild, as the only version affected is Deno 1.32.0. Deno Deploy users are not affected. The problem has been…

Affected software

SoftwareAffected versions
DenoServers and applications · cpe:a:deno:deno
  • Version 1.32.0
DenoServers and applications · github:denoland/deno
  • Version 1.32.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-28445
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-28445
  • GitHub Advisory Database https://github.com/advisories/GHSA-c25x-cm9x-qqgx
  • github.com https://github.com/denoland/deno/security/advisories/GHSA-c25x-cm9x-qqgx