CVE-2020-1914: Always-Incorrect Control Flow Implementation in Facebook Hermes
Summary
CVE-2020-1914: Always-Incorrect Control Flow Implementation in Facebook Hermes. Affects hermes-engine versions < 0.7.2. Fixed in 0.7.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Facebook Hermes is an open-source JavaScript engine designed for use in mobile applications, particularly React Native applications. It provides improved performance and memory efficiency compared to other JavaScript engines. However, prior to commit b2021df620824627f5a8c96615edbd1eb7fdddfc, Hermes contained a logic vulnerability when handling the SaveGeneratorLong instruction. This vulnerability could potentially allow attackers to read out of bounds or execute arbitrary code if the application using Hermes permits the evaluation of untrusted JavaScript. It's important to note that most React Native applications are not affected by this vulnerability.
Vulnerability Detail
The vulnerability in Facebook Hermes arises from an incorrect control flow implementation when handling the SaveGeneratorLong instruction. This flaw can be exploited by crafting malicious JavaScript code that triggers the vulnerable instruction. If successfully exploited, an attacker could read out of bounds or execute arbitrary code within the context of the application. The impact of this vulnerability depends on the specific use case and privileges granted to the JavaScript evaluation. Applications that allow the execution of untrusted JavaScript are at higher risk. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 9.8, indicating a critical severity level.
How To Fix
Latest published version: 0.11.0 as of 22 Oct 2026
npm install hermes-engine@0.11.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.7.2
This is the first release that contains the fix.
npm install hermes-engine@0.7.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the hermes-engine package to the fixed version to mitigate the risk.
Conclusion
The vulnerability in Facebook Hermes prior to commit b2021df620824627f5a8c96615edbd1eb7fdddfc allows for potential out-of-bounds reads or arbitrary code execution through crafted JavaScript. To mitigate this vulnerability, it is crucial to update the hermes-engine package to version 0.7.2 or later. Most React Native applications are not affected unless they permit the evaluation of untrusted JavaScript. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for hermes-engine →
FAQ
Most React Native applications are not affected by this vulnerability unless they allow the evaluation of untrusted JavaScript.
If successfully exploited, an attacker could read out of bounds or execute arbitrary code within the context of the application. The severity of the impact depends on the privileges granted to the JavaScript evaluation.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
Yes, the CVSS score for this vulnerability is 9.8, indicating a critical severity level.
No, there are no known workarounds for this vulnerability. It is essential to update the hermes-engine package to the fixed version.
References
Related vulnerabilities
Recent vulnerabilities recorded for hermes-engine.
