Always-Incorrect Control Flow Implementation in Facebook Hermes

published 2020-10-08 6 y ago modified 2026-06-17 4 mo ago also GHSA-327c-qx3v-h673 , EUVD-2022-2080

cvss: 9.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 2.5%; EPSS 2.5% chance of exploitation in 30 days, percentile 84%
public exploits: 0; none known

A logic vulnerability when handling the SaveGeneratorLong instruction in Facebook Hermes prior to commit b2021df620824627f5a8c96615edbd1eb7fdddfc allows attackers to potentially read out of bounds or theoretically execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.

Patch / fix

fixed in 2 links 1

npm hermes-engine 0.7.2
facebook hermes 2020-10-01

github.com/facebook/hermes@b2021df commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-1914 updated 2025-11-21 cvss 6.5

hermes: Out of bounds read in SaveGeneratorLong instruction

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.51% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
npm	hermes-engine	<0.7.2	0.7.2

Affected products

Facebook Hermes

Classification

Weakness

CWE-670 Always-Incorrect Control Flow Implementation
CWE-1119 Excessive Use of Unconditional Branching

References

github.com /facebook/hermes/commit/b2021df620824627f5a8c96615edbd1eb7fdddfc
web, patch, third-party-advisory
facebook.com /security/advisories/cve-2020-1914
web, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2020-1914
advisory
github.com /facebook/hermes/issues/373
web
github.com /facebook/hermes
package

Sources

CVE List CVE-2020-1914
GitHub Advisory GHSA-327c-qx3v-h673
NVD CVE-2020-1914

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary