{"id":"GHSA-f67q-wr6w-23jq","revision":"357bdf8de3a843bf9e730dc5c72d1de0","records":[{"revision":"357bdf8de3a843bf9e730dc5c72d1de0","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-f67q-wr6w-23jq","aliases":["CVE-2024-43367","RUSTSEC-2024-0444"],"title":"Boa has an uncaught exception when transitioning the state of `AsyncGenerator` objects","description":"A wrong assumption made when handling ECMAScript's `AsyncGenerator` operations can cause an uncaught exception on certain scripts.\n\n## Details\n\nBoa's implementation of `AsyncGenerator` makes the assumption that the state of an `AsyncGenerator` object cannot change while resolving a promise created by methods of `AsyncGenerator` such as `%AsyncGeneratorPrototype%.next`, `%AsyncGeneratorPrototype%.return`, or `%AsyncGeneratorPrototype%.throw`.\nHowever, a carefully constructed code could trigger a state transition from a getter method for the promise's `then` property, which causes the engine to fail an assertion of this assumption, causing an uncaught exception. This could be used to create a Denial Of Service attack in applications that run arbitrary ECMAScript code provided by an external user.\n\n## Patches\n\nVersion 0.19.0 is patched to correctly handle this case.\n\n## Workarounds\n\nUsers unable to upgrade to the patched version would want to use [`std::panic::catch_unwind`](https://doc.rust-lang.org/std/panic/fn.catch_unwind.html) to ensure any exceptions caused by the engine don't impact the availability of the main application.\n\n## References\n\n- https://github.com/boa-dev/boa/commit/69ea2f52ed976934bff588d6b566bae01be313f7\n- https://github.com/tc39/ecma262/security/advisories/GHSA-g38c-wh3c-5h9r","state":0,"publishedAt":"2024-08-14T20:49:51+00:00","modifiedAt":"2026-09-10T03:50:17.4030008+00:00","affected":[{"ecosystem":"crates.io","name":"boa_engine","ranges":[{"type":"ECOSYSTEM","events":[{"kind":"introduced","version":"0.16"},{"kind":"fixed","version":"0.19.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/boa-dev/boa/security/advisories/GHSA-f67q-wr6w-23jq","https://github.com/tc39/ecma262/security/advisories/GHSA-g38c-wh3c-5h9r","https://nvd.nist.gov/vuln/detail/CVE-2024-43367","https://github.com/boa-dev/boa/commit/69ea2f52ed976934bff588d6b566bae01be313f7","https://github.com/boa-dev/boa","https://rustsec.org/advisories/RUSTSEC-2024-0444.html"],"sourceUrl":"https://github.com/advisories/GHSA-f67q-wr6w-23jq","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-f67q-wr6w-23jq","identifiers":["GHSA-f67q-wr6w-23jq","CVE-2024-43367","RUSTSEC-2024-0444"]},"retained":false,"historicalAffected":[]}],"coverage":[]}