products / hermes

Hermes

Hermes is Meta's JavaScript engine for React Native. It compiles to ahead-of-time bytecode and ships inside mobile app binaries rather than as a standalone network service. Engine-level type confusion and memory-safety bugs still matter: untrusted JS evaluated in Hermes runs in the same process as the host app. NVD tracks the product as cpe:2.3:a:facebook:hermes.

api usage

Querying Hermes

product slughermes

version format0.4.2, 0.15.0

bash

curl "https://api.attestd.io/v1/check?product=hermes&version=0.4.2" \
  -H "Authorization: Bearer $ATTESTD_KEY"

Hermes 0.4.2 is affected by CVE-2020-1911 (CVSS 9.8). Type confusion on crafted prototype chains enables arbitrary code execution when the engine evaluates attacker-controlled JavaScript.

json

{
  "product": "hermes",
  "version": "0.4.2",
  "supported": true,
  "risk_state": "high",
  "risk_factors": [
    "remote_code_execution",
    "no_authentication_required",
    "internet_exposed_service",
    "patch_available"
  ],
  "actively_exploited": false,
  "remote_exploitable": true,
  "authentication_required": false,
  "patch_available": true,
  "fixed_version": "0.51.788",
  "confidence": 0.5,
  "cve_ids": [
    "CVE-2020-1896",
    "CVE-2020-1911",
    "CVE-2020-1912",
    "CVE-2020-1913",
    "CVE-2021-24037",
    "CVE-2021-24044",
    "CVE-2021-24045",
    "CVE-2022-27810",
    "CVE-2022-32234",
    "CVE-2022-35289",
    "CVE-2026-11322",
    "CVE-2026-22677",
    "CVE-2026-49957",
    "CVE-2026-53871",
    "CVE-2026-55196",
    "CVE-2026-58123",
    "CVE-2026-58174"
  ],
  "cves": null,
  "max_epss": 0.02418,
  "last_updated": "2026-07-16T11:45:52.614374Z",
  "supply_chain": null,
  "supply_chain_monitored": false,
  "typosquat": null
}

safe version

Hermes 0.15.0 sits above the NVD ranges for the type-confusion and out-of-bounds CVEs listed below, including CVE-2020-1911.

bash

curl "https://api.attestd.io/v1/check?product=hermes&version=0.15.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

notable cves

CVE history

Hermes CVEs cluster around type confusion and memory corruption in the runtime and compiler. Most require evaluating crafted JavaScript inside the engine. React Native apps that load dynamic or untrusted scripts inherit that trust boundary.

CVE	Description	Affects	CVSS
`CVE-2020-1911`	Type confusion on crafted prototype chains enables arbitrary code execution.	<0.4.3	9.8
`CVE-2021-24045`	Type confusion in typeof resolution enables RCE when untrusted JS is evaluated.	<0.10.0	9.8
`CVE-2022-32234`	Out-of-bounds write while handling large arrays enables RCE via crafted JS.	<0.12.0	9.8
`CVE-2023-23556`	BigInt-to-Number conversion error enables arbitrary code execution.	<2023-02-02	9.8

KEV = CISA Known Exploited Vulnerabilities catalog. Active exploitation confirmed.

data sources

facebook:hermes CPE

NVD records Hermes under Meta's Facebook vendor namespace. Some advisories use classic semver; others use dated cutoffs such as 2023-02-02 for release-train fixes.

cpe:2.3:a:facebook:hermesHermes engine CVEs

Attestd maps the hermes slug to this CPE and matches both semver and dated NVD version strings.

All products Node.js Deno Quickstart