# SES TypedArray hardening bypass with non-canonical numeric properties

Source: https://junglewise.ai/threats/ses-typedarray-hardening-bypass-with-non-canonical-numeric-properties-cd848030  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-10-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · Published 2022-10-20

SES is a JavaScript library that hardens objects to enable safe sharing between untrusted code segments (co-tenant programs). A defect in the hardening of TypedArray objects allowed properties with non-canonical numeric names (like "+0" instead of "0") to remain writable, enabling co-tenant programs to tamper with each other's APIs or exchange data they shouldn't be able to access.

Technologies: [ses (npm)](https://junglewise.ai/threats/technologies/ses). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 20 October 2022.

**Which products and versions are affected?** ses (npm) SEMVER:introduced=0,fixed=0.16.0.

**Is there a fix for This vulnerability?** Yes. ses (npm): upgrade to 0.16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked with local access.

**Am I affected?** Check whether you run ses (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ses (npm): upgrade to 0.16.0 or later

  ```sh
  npm install ses@0.16.0
  ```


## Technical details

The vulnerability is a logic error in the harden() function's handling of TypedArray properties. The harden function is designed to make non-indexed properties non-writable and non-configurable on TypedArrays, while allowing indexed properties (which hold numeric content) to remain mutable. However, the implementation failed to recognize and lock down properties with non-canonical numeric representations (e.g., "+0", "" which both parse to the number 0), leaving them writable and configurable. An attacker with access to a hardened TypedArray shared between co-tenant programs could use these non-canonical property names as a covert side-channel for API pollution attacks or arbitrary object communication. The vulnerability affects SES versions prior to 0.16.0, which introduced proper validation of non-integer numeric property names. Network reachability is not a factor; exploitation requires the attacker to have a reference to the shared TypedArray and the ability to execute code in a co-tenant context.

## Affected products

- Agoric SES <0.16.0

## Timeline

- 2022-10-19: disclosed
- 2022-10-20: patched: SES 0.16.0 released with fix

## References

- [https://github.com/endojs/endo/security/advisories/GHSA-whpx-q3rq-w8jc](https://github.com/endojs/endo/security/advisories/GHSA-whpx-q3rq-w8jc)
- [https://github.com/endojs/endo/commit/88cab0be4cf816dc578f2ff441fd9bcda0aa5cf5](https://github.com/endojs/endo/commit/88cab0be4cf816dc578f2ff441fd9bcda0aa5cf5)

## Related threats

- [ses library variable scope leakage in Compartment isolation](https://junglewise.ai/threats/cve-2025-32792-ses-library-variable-scope-leakage-in-compartment-isolation)
- [Endo SES dynamic import and spread operator sandbox escape](https://junglewise.ai/threats/cve-2023-39532-endo-ses-dynamic-import-and-spread-operator-sandbox-escape)
- [realms-shim sandbox breakout via Reflect.construct](https://junglewise.ai/threats/realms-shim-sandbox-breakout-via-reflect-construct-b4a099b5)