Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

serde_v8

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.9crates.ioPublished

    Deno improperly handles resizable ArrayBuffer

    CVE-2023-28445 · GHSA-c25x-cm9x-qqgx

    Affected
    • crates.io serde_v8 >= 0.87.0, <= 0.87.0
    Fixed in
    0.88.0· Vendor fix available
    Issue
    Impact Resizable ArrayBuffers passed to asynchronous native functions that are shrunk during the asynchronous operation could result in an out-of-bound read/write. It is unlikely that this has been exploited in the wild, as the only version affected is Deno 1.32.0. Deno Deploy users are not affected. Patches The problem has been resolved by disabling resizable ArrayBuffers temporarily in Deno 1.32.1. A future version of Deno will re-enable resizable ArrayBuffers with a proper fix. Workarounds Upgrade to Deno 1.32.1, or run with --v8-flags=--no-harmony-rab-gsab to disable resizable ArrayBuffers.

    Recommended action: Upgrade to 0.88.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →