# CVE-2020-1913: Facebook Hermes signed to unsigned conversion error

Source: https://junglewise.ai/threats/cve-2020-1913-facebook-hermes-signed-to-unsigned-conversion-error  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-05-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2020-1913 · Severity: low · CVSS 3.1 · Published 2022-05-24

Facebook Hermes is a JavaScript engine used primarily in React Native applications to execute JavaScript code. A signedness conversion error in the interpreter can allow attackers to crash the application or potentially execute arbitrary code if the app permits evaluation of untrusted JavaScript. Most standard React Native applications are not affected, but those that dynamically execute untrusted scripts face elevated risk.

Technologies: [Meta Hermes](https://junglewise.ai/threats/technologies/hermes), [hermes-engine (npm)](https://junglewise.ai/threats/technologies/hermes-engine). Vendors: [Meta](https://junglewise.ai/threats/vendors/meta), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2020-1913 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-1913 being exploited in the wild.

**How severe is CVE-2020-1913?** Low severity, with a CVSS score of 3.1, published 24 May 2022.

**Which products and versions are affected?** Meta Hermes prior to 0.5.2; hermes-engine (npm) SEMVER:introduced=0,fixed=0.5.2.

**Is there a fix for CVE-2020-1913?** Yes. hermes-engine (npm): upgrade to 0.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-1913 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2020-1913?** Check whether you run Meta Hermes or hermes-engine (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- hermes-engine (npm): upgrade to 0.5.2 or later

  ```sh
  npm install hermes-engine@0.5.2
  ```


## Technical details

The vulnerability is an integer signedness error (CWE-195, CWE-681) in the SwitchImm instruction handler of the JavaScript interpreter. The flaw involves reading a signed offset from an unsigned 32-bit pointer instead of a signed 32-bit pointer, allowing crafted JavaScript to bypass branching logic or corrupt instruction pointer calculations. The attack is network-reachable if the application evaluates untrusted JavaScript. An attacker can trigger a denial of service or potentially achieve remote code execution via malformed JavaScript bytecode. The fix, committed as 2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6, corrects the type casting for backward branch offset handling. Versions 0.5.2 and later contain the patch.

## Affected products

- Meta Hermes prior to 0.5.2

## Identifiers

- CVE-2020-1913
- GHSA-gmpm-xp43-f7g6

## Timeline

- 2020-09-09: disclosed: CVE-2020-1913 published to NVD
- 2022-05-24: patched: GHSA advisory published; fix available in version 0.5.2

## References

- [https://github.com/facebook/hermes/commit/2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6](https://github.com/facebook/hermes/commit/2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6)

## Related threats

- [Meta Hermes JavaScript engine use after free](https://junglewise.ai/threats/cve-2021-24037-meta-hermes-javascript-engine-use-after-free)
- [Meta Hermes out-of-bounds read in JavaScript interpreter](https://junglewise.ai/threats/cve-2020-1915-meta-hermes-out-of-bounds-read-in-javascript-interpreter)
- [Facebook Hermes out-of-bounds read in SaveGeneratorLong](https://junglewise.ai/threats/cve-2020-1914-facebook-hermes-out-of-bounds-read-in-savegeneratorlong)
- [Facebook Hermes out-of-bounds read/write in generator compilation](https://junglewise.ai/threats/cve-2020-1912-facebook-hermes-out-of-bounds-read-write-in-generator-compilation)
- [Facebook Hermes type confusion in prototype chain resolution](https://junglewise.ai/threats/cve-2020-1911-facebook-hermes-type-confusion-in-prototype-chain-resolution)