Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

neon

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Unratedcrates.ioPublished

    Use after free in Neon external buffers

    GHSA-8mj7-wxmc-f424

    Affected
    • crates.io neon >= 0.8.0, < 0.10.1
    Fixed in
    0.10.1· Vendor fix available
    Issue
    Neon provides functionality for creating JavaScript ArrayBuffer (and the Buffer subtype) instances backed by bytes allocated outside of V8/Node. The JsArrayBuffer::external and JsBuffer::external did not require T: 'static prior to Neon 0.10.1. This allowed creating an externally backed buffer from types that may be freed while they are still referenced by a JavaScript ArrayBuffer. The following example demonstrates use after free. It compiles on versions <0.10.1 and fails to compile afterward.

    Recommended action: Upgrade to 0.10.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →