What’s Vulnerable › Vulnerabilities

CVE-2022-27810

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-10-06 · updated 2026-06-17
• Weakness: CWE-674

Description

It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific maliciously formed JavaScript. This condition was only possible to trigger in dev-mode (when asserts were enabled). This issue affects Hermes versions prior to v0.12.0.

Affected products

• Facebook Hermes: before 0.12.0 — fixed in 0.12.0

How to fix

Upgrade to a fixed version: Facebook Hermes 0.12.0. Check the vendor advisory for mitigations.

References

• https://www.facebook.com/security/advisories/cve-2022-27810
• https://www.facebook.com/security/advisories/cve-2022-27810

Get alerted when CVE-2022-27810 or the next vulnerability affects your stack