CVE-2021-24045

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior to v0.10.0. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-843

Affected software

Vendor	Product	Versions
Facebook	Hermes	>= unspecified, < 0.10.0

References

https://github.com/facebook/hermes/commit/55e1b2343f4deb1a1b5726cfe1e23b2068217ff2Patch, Third Party Advisory
https://www.facebook.com/security/advisories/cve-2021-24045Vendor Advisory
https://github.com/facebook/hermes/commit/55e1b2343f4deb1a1b5726cfe1e23b2068217ff2Patch, Third Party Advisory
https://www.facebook.com/security/advisories/cve-2021-24045Vendor Advisory

Timeline

Published: Dec 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-240465.3A logic flaw in Ray-Ban® Stories device software allowed some parameters like video capture duration limit to be modified through the Facebo CVE-2021-24058.1Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management). Supported versions that are affec CVE-2021-24068.1Vulnerability in the Oracle Collaborative Planning product of Oracle E-Business Suite (component: User Interface). Supported versions that a CVE-2021-240668.8Microsoft SharePoint Remote Code Execution Vulnerability CVE-2021-240677.8Microsoft Excel Remote Code Execution Vulnerability CVE-2021-240687.8Microsoft Excel Remote Code Execution Vulnerability CVE-2021-240697.8Microsoft Excel Remote Code Execution Vulnerability CVE-2021-24075.3Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affecte CVE-2021-240707.8Microsoft Excel Remote Code Execution Vulnerability CVE-2021-240715.3Microsoft SharePoint Information Disclosure Vulnerability CVE-2021-240728.8Microsoft SharePoint Server Remote Code Execution Vulnerability CVE-2021-240736.5Skype for Business and Lync Spoofing Vulnerability