CVE-2021-24045

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2021-24045

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-24045.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2021-24045

Published

2021-12-13T21:15:08.923Z

Modified

2026-04-11T13:53:55.377360Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior to v0.10.0. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.

References

Affected packages

Git / github.com/facebook/hermes

Affected ranges

Type

GIT

Repo

https://github.com/facebook/hermes

Events

Introduced

Fixed

98f5028619294b6b14cddf5903a0f831d0edef9c

Fixed

55e1b2343f4deb1a1b5726cfe1e23b2068217ff2

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.10.0"
        }
    ]
}

Affected versions

v0.*

v0.1.0

v0.1.1

v0.2.1

v0.3.0

v0.4.0

v0.5.0

v0.6.0

v0.7.0

v0.8.0

v0.9.0

Database specific

vanir_signatures_modified

"2026-04-11T13:53:55Z"

vanir_signatures

[
    {
        "id": "CVE-2021-24045-18d585de",
        "target": {
            "file": "lib/IR/IREval.cpp",
            "function": "hermes::evalUnaryOperator"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "210189128054367564957160263332755954752",
            "length": 1593.0
        },
        "signature_type": "Function",
        "source": "https://github.com/facebook/hermes/commit/55e1b2343f4deb1a1b5726cfe1e23b2068217ff2",
        "signature_version": "v1"
    },
    {
        "id": "CVE-2021-24045-2abf4027",
        "target": {
            "file": "lib/VM/JSLib/Object.cpp",
            "function": "createObjectConstructor"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "28119057494351730174264949473428385543",
            "length": 4517.0
        },
        "signature_type": "Function",
        "source": "https://github.com/facebook/hermes/commit/98f5028619294b6b14cddf5903a0f831d0edef9c",
        "signature_version": "v1"
    },
    {
        "id": "CVE-2021-24045-3fe77b4f",
        "target": {
            "file": "lib/VM/JSLib/Object.cpp"
        },
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "156164893267926276119498081931587824656",
                "130702755843183064893722258247476490947",
                "187778433998099261786328089378702710635",
                "325593157944680459102889579367643710387"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "source": "https://github.com/facebook/hermes/commit/98f5028619294b6b14cddf5903a0f831d0edef9c",
        "signature_version": "v1"
    },
    {
        "id": "CVE-2021-24045-86b84167",
        "target": {
            "file": "lib/IR/IREval.cpp"
        },
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "318557679244333546349812987575074249562",
                "237607294457643462554712443821820446880",
                "318253231071571976976921282638770343067",
                "225974687793471217526900685326065131464"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "source": "https://github.com/facebook/hermes/commit/55e1b2343f4deb1a1b5726cfe1e23b2068217ff2",
        "signature_version": "v1"
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-24045.json"