CVE-2021-24044: Hermes Engine - Access of Resource Using Incompatible Type
Summary
Your scan reports hermes-engine 0.5.1. Fixed in 0.10.0.
CVE-2021-24044: Access of Resource Using Incompatible Type in Hermes. Affects hermes-engine versions < 0.10.0. Fixed in 0.10.0. How to fix ↓
Background
Hermes Engine is an open-source JavaScript engine developed by Facebook. It is designed to optimize the execution of JavaScript code on mobile devices. The engine is widely used in various applications and frameworks. However, prior to version 0.10.0, Hermes Engine is vulnerable to an access of resource using incompatible type issue.
Vulnerability Detail
The vulnerability arises when invalid JavaScript code is passed to Hermes Engine, specifically when await and yield are called upon non-async and non-generator getter/setter functions. In such cases, Hermes Engine mistakenly invokes generator functions and encounters errors due to invalid await/yield positions. This can lead to a segmentation fault caused by a type confusion error, with a low chance of remote code execution (RCE). The vulnerability has been assigned a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 0.11.0 as of 22 Oct 2026
npm install hermes-engine@0.11.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.10.0
This is the first release that contains the fix.
npm install hermes-engine@0.10.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update Hermes Engine to the fixed version as soon as possible.
Conclusion
The access of resource using incompatible type vulnerability in Hermes Engine (CVE-2021-24044) poses a critical risk to applications utilizing the engine. It is crucial to update to version 0.10.0 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for hermes-engine →
FAQ
Hermes Engine is an open-source JavaScript engine developed by Facebook. It is designed to optimize the execution of JavaScript code on mobile devices.
The vulnerability can result in a segmentation fault due to a type confusion error, with a low chance of remote code execution (RCE). It is considered critical and should be addressed promptly.
To fix this vulnerability, update Hermes Engine to version 0.10.0 or later. This version includes the necessary patches to address the issue.
No, there is no known workaround for this vulnerability. Updating to the fixed version is the recommended solution.
For more information, you can refer to the GitHub Advisory Database entry for this vulnerability: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-7mhc-prgv-r3q4/GHSA-7mhc-prgv-r3q4.json
Related vulnerabilities
Recent vulnerabilities recorded for hermes-engine.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.