{"id":"CVE-2021-24045","details":"A type confusion vulnerability could be triggered when resolving the \"typeof\" unary operator in Facebook Hermes prior to v0.10.0. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.","modified":"2026-07-09T00:12:53.385274Z","published":"2021-12-13T21:15:08.923Z","references":[{"type":"ADVISORY","url":"https://www.facebook.com/security/advisories/cve-2021-24045"},{"type":"FIX","url":"https://github.com/facebook/hermes/commit/55e1b2343f4deb1a1b5726cfe1e23b2068217ff2"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/facebook/hermes","events":[{"introduced":"0"},{"fixed":"98f5028619294b6b14cddf5903a0f831d0edef9c"},{"fixed":"55e1b2343f4deb1a1b5726cfe1e23b2068217ff2"}],"database_specific":{"cpe":"cpe:2.3:a:facebook:hermes:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"0.10.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v0.9.0","v0.8.0","v0.7.0","v0.6.0","v0.5.0","v0.4.0","v0.3.0","v0.2.1","v0.1.1","v0.1.0"],"database_specific":{"vanir_signatures":[{"digest":{"length":1593,"function_hash":"210189128054367564957160263332755954752"},"id":"CVE-2021-24045-18d585de","signature_type":"Function","signature_version":"v1","source":"https://github.com/facebook/hermes/commit/55e1b2343f4deb1a1b5726cfe1e23b2068217ff2","target":{"file":"lib/IR/IREval.cpp","function":"hermes::evalUnaryOperator"},"deprecated":false},{"digest":{"function_hash":"28119057494351730174264949473428385543","length":4517},"id":"CVE-2021-24045-2abf4027","signature_type":"Function","signature_version":"v1","source":"https://github.com/facebook/hermes/commit/98f5028619294b6b14cddf5903a0f831d0edef9c","target":{"file":"lib/VM/JSLib/Object.cpp","function":"createObjectConstructor"},"deprecated":false},{"id":"CVE-2021-24045-3fe77b4f","signature_type":"Line","signature_version":"v1","source":"https://github.com/facebook/hermes/commit/98f5028619294b6b14cddf5903a0f831d0edef9c","target":{"file":"lib/VM/JSLib/Object.cpp"},"deprecated":false,"digest":{"line_hashes":["156164893267926276119498081931587824656","130702755843183064893722258247476490947","187778433998099261786328089378702710635","325593157944680459102889579367643710387"],"threshold":0.9}},{"digest":{"line_hashes":["318557679244333546349812987575074249562","237607294457643462554712443821820446880","318253231071571976976921282638770343067","225974687793471217526900685326065131464"],"threshold":0.9},"id":"CVE-2021-24045-86b84167","signature_type":"Line","signature_version":"v1","source":"https://github.com/facebook/hermes/commit/55e1b2343f4deb1a1b5726cfe1e23b2068217ff2","target":{"file":"lib/IR/IREval.cpp"},"deprecated":false}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-24045.json","vanir_signatures_modified":"2026-07-09T00:12:53Z"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}