CVE-2024-27935 Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination
Cross-session data contamination in Deno's Node.js compatibility layer allows attackers to read data from other sessions via shared buffers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-27935?
CVE-2024-27935 is a high-severity vulnerability in denoland deno, published on 6 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.35.1 and prior to version 1.36.3, a vulnerability in Deno's Node.js compatibility runtime allows for cross-session data contamination during simultaneous asynchronous reads from Node.js streams sourced from sockets or files. The issue arises from the re-use of a global buffer (BUF) in stream_wrap.ts used as a performance optimization to limit allocations during these asynchronous read operations. This can lead to data intended for one session being received by another session, potentially resulting in data corruption and unexpected behavior. This affects all users of Deno that use the node.js compatibility layer for network communication or other streams, including packages that may require node.js libraries indirectly. Version 1.36.3 contains a patch for this issue.
Weakness: CWE-488
Which versions are affected by CVE-2024-27935?
2 open source packages ship an affected version, including deno. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
deno crates.io | From 1.35.1 | 1.36.3 |
deno crates.io | From 1.35.1 | 1.36.3 |
Products include Deno Deno.
How do I fix CVE-2024-27935?
Upgrade deno to 1.36.3 or later.
Is CVE-2024-27935 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-27935 exists.
Other vulnerabilities in denoland deno
- CVE-2023-28445 Deno improperly handles resizable ArrayBuffer
- CVE-2022-24783 Sandbox bypass leading to arbitrary code execution in Deno
- CVE-2021-32619 Static imports inside dynamically imported modules do not adhere to permission checks
- CVE-2026-22863 Deno node:crypto doesn't finalize cipher
- CVE-2024-27936 Deno interactive permission prompt spoofing via improper ANSI stripping
Sources
Also known as GHSA-wrqv-pf6j-mqjp.