Description
@fastly/js-compute is a JavaScript SDK and runtime for building Fastly Compute applications. The implementation of several functions were determined to include a use-after-free bug. This bug could allow for unintended data loss if the result of the preceding functions were sent anywhere else, and often results in a guest trap causing services to return a 500. This bug has been fixed in version 3.16.0 of the `@fastly/js-compute` package.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_confirm
https://github.com/fastly/js-compute-runtime/security/advisories/GHSA-mp3g-vpm9-9vqv
Scores
CVSS v3
5.3
EPSS
0.0027
EPSS Percentile
17.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-416
Status
published
Products (2)
fastly/js-compute
3.0.0 - 3.16.0npm
fastly/js-compute-runtime
>= 3.0.0, < 3.16.0
Published
Jun 26, 2024
Tracked Since
Feb 18, 2026