CVE-2020-1915 json
Out-of-bounds Read in Facebook Hermes
published 2020-10-26 6 y ago modified 2026-06-17 4 mo ago also GHSA-x4cf-6jr3-3qvp , EUVD-2022-5710
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.6%
- EPSS 1.6% chance of exploitation in 30 days, percentile 76%
- public exploits
- 0
- none known
Summary
An out-of-bounds read in the JavaScript Interpreter in Facebook Hermes prior to commit 8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0 allows attackers to cause a denial of service attack or possible further memory corruption via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
Patch / fix
Exploit prediction
1.60% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:N/A:P |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | hermes-engine | <0.7.2 |
0.7.2 |
Affected products
- Facebook Hermes
Classification
- Weakness
-
- CWE-125 Out-of-bounds Read
References
-
github.com
/facebook/hermes/commit/8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0
web, patch, third-party-advisory
-
facebook.com
/security/advisories/cve-2020-1915
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-1915
advisory
-
github.com
/facebook/hermes/issues/373
web
-
github.com
/facebook/hermes
package
Sources
- CVE List CVE-2020-1915
- GitHub Advisory GHSA-x4cf-6jr3-3qvp
- NVD CVE-2020-1915
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.