CVE-2022-27810

7.5 highEPSS 0.9%

High (7.5) in facebook hermes. EPSS 0.9% chance of exploitation in the next 30 days.

It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific maliciously formed JavaScript. This condition was only possible to trigger in dev-mode (when asserts were enabled). This issue affects Hermes versions prior to v0.12.0.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 59% of CVEs (scores of 2026-10-31)
CWE: CWE-674
Published: 2022-10-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

facebook:hermes

References

https://www.facebook.com/security/advisories/cve-2022-27810
https://www.facebook.com/security/advisories/cve-2022-27810

Check your stack JSON