Facebook Hermes vulnerabilities

CVEs per yearBy the year they were published

1. 20205
2. 20213
3. 20225
4. 20237

Newest CVEs

• CVE-2023-30470

  A use-after-free related to unsound inference in the bytecode generation when optimizations are enabled for Hermes prior to commit…

  Facebook · Hermes

  Critical9.8
• CVE-2023-28081

  A bytecode optimization bug in Hermes prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could be used to cause an use-after-free and obtain arbitrary…

  Facebook · Hermes

  Critical9.8
• CVE-2023-25933

  A type confusion bug in TypedArray prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could have been used by a malicious attacker to execute arbitrary…

  Facebook · Hermes

  Critical9.8
• CVE-2023-24833

  A use-after-free in BigIntPrimitive addition in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by an attacker to leak raw…

  Facebook · Hermes

  High7.5
• CVE-2023-24832

  A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to crash an Hermes…

  Facebook · Hermes

  High7.5
• CVE-2023-23557

  An error in Hermes' algorithm for copying objects properties prior to commit a00d237346894c6067a594983be6634f4168c9ad could be used by a malicious attacker to…

  Facebook · Hermes

  Critical9.8
• CVE-2023-23556

  An error in BigInt conversion to Number in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by a malicious attacker to…

  Facebook · Hermes

  Critical9.8
• CVE-2022-40138

  An integer conversion error in Hermes bytecode generation, prior to commit 6aa825e480d48127b480b08d13adf70033237097, could have been used to perform…

  Facebook · Hermes

  Critical9.8
• CVE-2022-35289

  A write-what-where condition in hermes caused by an integer overflow, prior to commit 5b6255ae049fa4641791e47fad994e8e8c4da374 allows attackers to potentially…

  Facebook · Hermes

  Critical9.8
• CVE-2022-32234

  An out of bounds write in hermes, while handling large arrays, prior to commit 06eaec767e376bfdb883d912cb15e987ddf2bda1 allows attackers to potentially execute…

  Facebook · Hermes

  Critical9.8