CVE-2020-1915: Out-of-bounds Read in Facebook Hermes
Summary
CVE-2020-1915: Out-of-bounds Read in Facebook Hermes. Affects hermes-engine versions < 0.7.2. Fixed in 0.7.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'hermes-engine' package is an open-source JavaScript engine developed by Facebook. It is primarily used in React Native applications to execute JavaScript code. Hermes provides improved performance and memory efficiency compared to other JavaScript engines. However, a vulnerability has been discovered in versions prior to 0.7.2 that can lead to a denial of service attack or potential memory corruption when processing crafted JavaScript. It is important to note that this vulnerability can only be exploited if the application allows the evaluation of untrusted JavaScript. Therefore, most React Native applications are not affected.
Vulnerability Detail
The vulnerability in Facebook Hermes (CVE-2020-1915) is an out-of-bounds read in the JavaScript Interpreter. This means that when processing certain JavaScript code, the interpreter may attempt to read data from memory locations outside of the allocated boundaries. This can result in a denial of service attack, causing the application to crash, or potentially lead to further memory corruption. However, it is crucial to highlight that this vulnerability can only be exploited if the application permits the evaluation of untrusted JavaScript. Most React Native applications are not affected because they do not allow the execution of untrusted JavaScript.
How To Fix
Latest published version: 0.11.0 as of 22 Oct 2026
npm install hermes-engine@0.11.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.7.2
This is the first release that contains the fix.
npm install hermes-engine@0.7.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the 'hermes-engine' package is not immediately feasible, a temporary workaround is to disable the evaluation of untrusted JavaScript in the application. By ensuring that only trusted JavaScript code is executed, the vulnerability can be mitigated. However, this workaround may limit the functionality of the application and should only be considered as a temporary solution until the package can be updated.
Conclusion
The vulnerability in Facebook Hermes (CVE-2020-1915) is an out-of-bounds read issue that can lead to a denial of service attack or potential memory corruption. Most React Native applications are not affected unless they allow the evaluation of untrusted JavaScript. To mitigate this vulnerability, it is recommended to update the 'hermes-engine' package to version 0.7.2 or later. If immediate updating is not possible, disabling the evaluation of untrusted JavaScript can serve as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for hermes-engine →
FAQ
Versions of 'hermes-engine' up to and including 0.7.1 are affected by this vulnerability.
No, most React Native applications are not affected by this vulnerability. Only applications that allow the evaluation of untrusted JavaScript are at risk.
The vulnerability can lead to a denial of service attack, causing the application to crash. It may also result in memory corruption, which could potentially be exploited for further malicious activities.
There is no known exploit for this vulnerability at the moment. However, it is important to apply the necessary updates to prevent any potential exploitation.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. It analyzes the package-lock.json file and provides real-time monitoring and alerts for open-source vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for hermes-engine.
