# CVE-2020-1915: Meta Hermes out-of-bounds read in JavaScript interpreter

Source: https://junglewise.ai/threats/cve-2020-1915-meta-hermes-out-of-bounds-read-in-javascript-interpreter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-05-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2020-1915 · Severity: low · CVSS 3.1 · Published 2022-05-24

Facebook Hermes is a lightweight JavaScript engine used in React Native applications. An out-of-bounds memory read in the interpreter allows an attacker to crash the application or corrupt memory by executing specially crafted JavaScript code. This vulnerability only affects applications that permit evaluation of untrusted JavaScript; most standard React Native apps are not impacted.

Technologies: [Meta Hermes](https://junglewise.ai/threats/technologies/hermes), [hermes-engine (npm)](https://junglewise.ai/threats/technologies/hermes-engine). Vendors: [Meta](https://junglewise.ai/threats/vendors/meta), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2020-1915 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-1915 being exploited in the wild.

**How severe is CVE-2020-1915?** Low severity, with a CVSS score of 3.1, published 24 May 2022.

**Which products and versions are affected?** Meta Hermes prior to 0.7.2; hermes-engine (npm) SEMVER:introduced=0,fixed=0.7.2.

**Is there a fix for CVE-2020-1915?** Yes. hermes-engine (npm): upgrade to 0.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-1915 attacked?** It is attacked over the network.

**Am I affected by CVE-2020-1915?** Check whether you run Meta Hermes or hermes-engine (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- hermes-engine (npm): upgrade to 0.7.2 or later

  ```sh
  npm install hermes-engine@0.7.2
  ```


## Technical details

An out-of-bounds read (CWE-125) exists in the JavaScript interpreter component of Facebook Hermes prior to commit 8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0. An attacker can trigger this vulnerability by providing crafted JavaScript code to an application that evaluates untrusted code. The vulnerability allows denial of service via interpreter crash and potential information disclosure through out-of-bounds memory reads. The vulnerability is network-reachable if the affected application accepts remote code execution, though no user interaction is required. A fix was released in Hermes 0.7.2 and later.

## Affected products

- Meta Hermes prior to 0.7.2

## Identifiers

- CVE-2020-1915
- GHSA-x4cf-6jr3-3qvp

## Timeline

- 2020-10-26: disclosed
- 2020-09-29: patched: Fix included in v0.7.2

## References

- [https://github.com/facebook/hermes/issues/373](https://github.com/facebook/hermes/issues/373)

## Related threats

- [Meta Hermes JavaScript engine use after free](https://junglewise.ai/threats/cve-2021-24037-meta-hermes-javascript-engine-use-after-free)
- [Facebook Hermes out-of-bounds read in SaveGeneratorLong](https://junglewise.ai/threats/cve-2020-1914-facebook-hermes-out-of-bounds-read-in-savegeneratorlong)
- [Facebook Hermes signed to unsigned conversion error](https://junglewise.ai/threats/cve-2020-1913-facebook-hermes-signed-to-unsigned-conversion-error)
- [Facebook Hermes out-of-bounds read/write in generator compilation](https://junglewise.ai/threats/cve-2020-1912-facebook-hermes-out-of-bounds-read-write-in-generator-compilation)
- [Facebook Hermes type confusion in prototype chain resolution](https://junglewise.ai/threats/cve-2020-1911-facebook-hermes-type-confusion-in-prototype-chain-resolution)