# CVE-2020-1914: Facebook Hermes out-of-bounds read in SaveGeneratorLong

Source: https://junglewise.ai/threats/cve-2020-1914-facebook-hermes-out-of-bounds-read-in-savegeneratorlong  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-05-24. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2020-1914 · Severity: low · CVSS 3.1 · Published 2022-05-24

Facebook Hermes is a JavaScript engine used to optimize React Native applications. A logic error in how the engine handles specific instructions could allow an attacker to read sensitive memory or execute unauthorized code. This risk primarily affects applications that allow the execution of untrusted or user-provided JavaScript code.

Technologies: [Meta Hermes](https://junglewise.ai/threats/technologies/hermes), [hermes-engine (npm)](https://junglewise.ai/threats/technologies/hermes-engine). Vendors: [Meta](https://junglewise.ai/threats/vendors/meta), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2020-1914 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-1914 being exploited in the wild.

**How severe is CVE-2020-1914?** Low severity, with a CVSS score of 3.1, published 24 May 2022.

**Which products and versions are affected?** Meta Hermes <= 0.7.1; hermes-engine (npm) SEMVER:introduced=0,fixed=0.7.2.

**Is there a fix for CVE-2020-1914?** Yes. hermes-engine (npm): upgrade to 0.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-1914 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2020-1914?** Check whether you run Meta Hermes or hermes-engine (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- hermes-engine (npm): upgrade to 0.7.2 or later

  ```sh
  npm install hermes-engine@0.7.2
  ```


## Technical details

A logic vulnerability exists in the Facebook Hermes JavaScript engine when handling the SaveGeneratorLong instruction. The root cause is an incorrect control flow implementation where the engine would jump to an incorrect next instruction based on the length of the SaveGenerator instruction. An attacker can exploit this by providing crafted JavaScript to trigger an out-of-bounds read or potentially achieve arbitrary code execution. This vulnerability is only exploitable in environments where the application permits the evaluation of untrusted JavaScript. The issue was addressed in version 0.7.2 by ensuring the interpreter loop correctly dispatches the next instruction.

## Affected products

- Facebook hermes-engine <= 0.7.1

## Identifiers

- CVE-2020-1914
- GHSA-327c-qx3v-h673

## Timeline

- 2020-10-08: advisory: NVD and Facebook published initial advisory
- 2020-10-01: patched: Fix committed to Hermes repository
- 2022-05-24: disclosed: GitHub Advisory published

## References

- [https://github.com/facebook/hermes/issues/373](https://github.com/facebook/hermes/issues/373)
- [https://github.com/facebook/hermes/commit/b2021df620824627f5a8c96615edbd1eb7fdddfc](https://github.com/facebook/hermes/commit/b2021df620824627f5a8c96615edbd1eb7fdddfc)
- [https://github.com/facebook/hermes](https://github.com/facebook/hermes)
- [https://www.facebook.com/security/advisories/cve-2020-1914](https://www.facebook.com/security/advisories/cve-2020-1914)

## Related threats

- [Meta Hermes JavaScript engine use after free](https://junglewise.ai/threats/cve-2021-24037-meta-hermes-javascript-engine-use-after-free)
- [Meta Hermes out-of-bounds read in JavaScript interpreter](https://junglewise.ai/threats/cve-2020-1915-meta-hermes-out-of-bounds-read-in-javascript-interpreter)
- [Facebook Hermes signed to unsigned conversion error](https://junglewise.ai/threats/cve-2020-1913-facebook-hermes-signed-to-unsigned-conversion-error)
- [Facebook Hermes out-of-bounds read/write in generator compilation](https://junglewise.ai/threats/cve-2020-1912-facebook-hermes-out-of-bounds-read-write-in-generator-compilation)
- [Facebook Hermes type confusion in prototype chain resolution](https://junglewise.ai/threats/cve-2020-1911-facebook-hermes-type-confusion-in-prototype-chain-resolution)