Vulnerability · Published Mar 6, 2024 · Assigned by GitHub_M

CVE-2024-27935Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination

High 7.2

In plain English

A high-severity security flaw in deno from denoland. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.7%top 45.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.35.1 and prior to version 1.36.3, a vulnerability in Deno's Node.js compatibility runtime allows for cross-session data contamination during simultaneous asynchronous reads from Node.js streams sourced from sockets or files. The issue arises from the re-use of a global buffer (BUF) in stream_wrap.ts used as a performance optimization to limit allocations during these asynchronous read operations. This can lead to data intended for one session being received by another session, potentially resulting in data corruption and unexpected behavior. This affects all users of Deno that use the node.js compatibility layer for network communication or other streams, including packages that may require node.js libraries indirectly. Version 1.36.3 contains a patch for this issue.

Affected products (as reported)

Vendor	Product	Versions
denoland	deno	>= 1.35.1, < 1.36.3

Weakness: CWE-488 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L

References

https://github.com/denoland/deno/security/advisories/GHSA-wrqv-pf6j-mqjp x_refsource_CONFIRM
https://github.com/denoland/deno/issues/20188 x_refsource_MISC
https://github.com/denoland/deno/commit/3e9fb8aafd9834ebacd27734cea4310caaf794c6 x_refsource_MISC