TI-2022-19028 Aliases CVE-2022-40138 GHSA-qg8w-6wvf-6vp6

Incorrect numeric conversion in Meta Hermes

MEDIUM 44CWE-681Published 2022-10-11 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

An integer conversion error in Hermes bytecode generation, prior to commit 6aa825e480d48127b480b08d13adf70033237097, could have been used to perform Out-Of-Bounds operations and subsequently execute arbitrary code. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.

Why it matters now

EPSS 0.01212 68th percentileScored 2026-11-07

Fix Fixed Hermes (Facebook): commit prior to 6aa825e480d48127b480b08d13adf70033237097

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Meta	Hermes	before commit prior to 6aa825e480d48127b480b08d13adf70033237097	commit prior to 6aa825e480d48127b480b08d13adf70033237097	Patch available	CNA

Hermes VendorMeta Affected before commit prior to 6aa825e480d48127b480b08d13adf70033237097 Fixed in commit prior to 6aa825e480d48127b480b08d13adf70033237097 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:facebook:hermes::::::::	before 2022-09-27	Vulnerable	Meta

cpe:2.3:a:facebook:hermes:*:*:*:*:*:*:*:* Versions before 2022-09-27 Vulnerable ·Meta

Remediation

Fix · CNA Hermes (Facebook) Fixed in commit prior to 6aa825e480d48127b480b08d13adf70033237097

Timeline

2026-10-02 Threatist record created from CVE-2022-40138
2026-10-03 Alias added: GHSA-qg8w-6wvf-6vp6

References

Patch 1

https://github.com/facebook/hermes/commit/6aa825e480d48127b480b08d13adf70033237097

Advisory 1

https://www.facebook.com/security/advisories/CVE-2022-40138

TI-2023-14306 Use after free in Meta Hermes CVSS 3.1CRITICAL 9.8
TI-2023-12661 Use after free in Meta Hermes CVSS 3.1CRITICAL 9.8
TI-2023-11181 Type confusion in Meta Hermes CVSS 3.1CRITICAL 9.8
TI-2023-09388 Type confusion in Meta Hermes CVSS 3.1CRITICAL 9.8
TI-2023-09387 Out-of-bounds write in Meta Hermes CVSS 3.1CRITICAL 9.8
TI-2020-01841 A logic vulnerability when handling the SaveGeneratorLong instruction in Facebook Hermes… CVSS 3.1CRITICAL 9.8

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences