CVE-2024-27935: 
Rust vulnerability analysis and mitigation

A vulnerability (CVE-2024-27935) was discovered in Deno's Node.js compatibility runtime affecting versions 1.35.1 through 1.36.3. The vulnerability allows for cross-session data contamination during simultaneous asynchronous reads from Node.js streams. This security issue was discovered in the stream handling mechanism and was patched in version 1.36.3 (Deno Advisory).

The vulnerability stems from the re-use of a global buffer (BUF) in stream_wrap.ts, which was implemented as a performance optimization to limit allocations during asynchronous read operations. When multiple independent network socket connections are involved, data intended for one session could be received by another session due to improper isolation of the global buffer. The issue affects both network streams and non-network Node.js Streams such as those created from files. The vulnerability has been assigned a CVSS v3.1 base score of 7.2 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L (Deno Advisory).

The vulnerability affects all users of Deno that utilize the Node.js compatibility layer for network communication or other streams, including packages that may require Node.js libraries indirectly. In cases where the net.Stream is connected to a remote server such as a database or key/value store like Redis, this can result in packets received on one connection being presented to another, causing data cross-contamination between multiple users and potentially leaking sensitive information (Deno Advisory).

The vulnerability can be triggered when multiple independent network socket connections are involved. For example, when two separate server sockets receive data from their respective client sockets and echo the received data back, data from one socket may appear on another socket. A proof of concept has been documented in issue #20188 (GitHub Issue).

The vulnerability has been patched in Deno version 1.36.3. Users are advised to upgrade to this version or later to address the issue. It's important to note that this vulnerability does not affect Deno network streams created with the Deno.listen and Deno.connect APIs (Deno Advisory).