CVE-2020-1913: Signed to Unsigned Conversion Error in Facebook Hermes
Summary
CVE-2020-1913: Signed to Unsigned Conversion Error in Facebook Hermes. Affects hermes-engine versions < 0.5.2. Fixed in 0.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Facebook Hermes is a JavaScript engine used in React Native applications for improved performance. It provides an efficient runtime environment for executing JavaScript code. However, a vulnerability has been discovered in Hermes that allows for an Integer signedness error in the JavaScript Interpreter. This vulnerability can be exploited by attackers to cause a denial of service attack or potentially execute remote code. It is important to note that this vulnerability can only be exploited if the application using Hermes allows the evaluation of untrusted JavaScript. Most React Native applications are not affected by this issue.
Vulnerability Detail
The vulnerability in Facebook Hermes is due to an Integer signedness error in the JavaScript Interpreter. This error occurs when there is a conversion from signed to unsigned integers, leading to unexpected behavior. Attackers can craft malicious JavaScript code to trigger this vulnerability and potentially cause a denial of service attack or execute remote code. The impact of this vulnerability depends on the application's usage of Hermes and its handling of untrusted JavaScript. If the application does not evaluate untrusted JavaScript, it is not vulnerable to this issue.
How To Fix
Latest published version: 0.11.0 as of 22 Oct 2026
npm install hermes-engine@0.11.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.2
This is the first release that contains the fix.
npm install hermes-engine@0.5.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the hermes-engine package is not feasible immediately, a possible workaround is to disable the evaluation of untrusted JavaScript in the application. By ensuring that only trusted JavaScript is executed, the vulnerability can be mitigated. However, this workaround may impact the functionality of the application, so updating to the fixed version is still the recommended solution.
Conclusion
The Integer signedness error in Facebook Hermes can lead to a denial of service attack or potential remote code execution. It is crucial to update the hermes-engine package to version 0.5.2 or later to mitigate this vulnerability. If immediate updating is not feasible, disabling the evaluation of untrusted JavaScript can serve as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for hermes-engine →
FAQ
This vulnerability affects applications that use the hermes-engine package and allow the evaluation of untrusted JavaScript. Most React Native applications are not affected as they do not permit the execution of untrusted JavaScript.
The impact of this vulnerability can range from a denial of service attack to potential remote code execution. However, it is important to note that the impact depends on the application's usage of Hermes and its handling of untrusted JavaScript.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, a fix is available for this vulnerability. It is recommended to update the hermes-engine package to version 0.5.2 or later to address the Integer signedness error.
If updating the hermes-engine package is not immediately possible, a workaround is to disable the evaluation of untrusted JavaScript in the application. However, this workaround may impact the functionality of the application.
Related vulnerabilities
Recent vulnerabilities recorded for hermes-engine.
