Exposure of Resource to Wrong Sphere in Deno - CVE-2024-27935
Published: March 5, 2024 / Updated: April 23, 2026
Vulnerability identifier: #VU127051
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-27935
CWE-ID: CWE-668
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information and cause data corruption.
The vulnerability exists due to improper isolation of a global buffer in stream_wrap.ts in Deno's Node.js compatibility runtime when performing simultaneous asynchronous reads from Node.js streams sourced from sockets or files. A remote attacker can trigger concurrent stream reads to disclose sensitive information and cause data corruption.
The issue does not affect network streams created with the Deno.listen and Deno.connect APIs.
Affected software
Deno
How to mitigate CVE-2024-27935
Install security update from vendor's website.
Deno - update to 1.36.3