Every CVE Search/ Get API key

CVE-2024-38375

@fastly/js-compute use-after-free in some host call implementations

5.3 MediumFix available

@fastly/js-compute is a JavaScript SDK and runtime for building Fastly Compute applications. The implementation of several functions were determined to include a use-after-free bug. This bug could allow for unintended data loss if the result of the preceding functions were sent anywhere else, and often results in a guest trap causing services to return a 500. This bug has been fixed in version 3.16.0 of the @fastly/js-compute package.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
High
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
High

Exploit likelihood

0.27%Up 0.2 points since Jun 27, 2024
90%50%10%1%

What each source reports

CVE List Score used 5.3

@fastly/js-compute use-after-free in some host call implementations

@fastly/js-compute is a JavaScript SDK and runtime for building Fastly Compute applications. The implementation of several functions were determined to include a use-after-free bug. This bug could allow for unintended data loss if the result of the preceding functions were sent anywhere else, and often results in a guest trap causing services to return a 500. This bug has been fixed in version 3.16.0 of the @fastly/js-compute package.

Record
CVE-2024-38375
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:H
Weakness
CWE-416
Updated
2026-11-02
EUVDEUVD-2024-2111 5.3

@fastly/js-compute is a JavaScript SDK and runtime for building Fastly Compute applications. The implementation of several functions were determined to include a use-after-free bug. This bug could allow for unintended data loss if the result of the preceding functions were sent anywhere else, and often results in a guest trap causing services to return a 500. This bug has been fixed in version 3.16.0 of the @fastly/js-compute package.

Record
EUVD-2024-2111
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-mp3g-vpm9-9vqv 5.3

@fastly/js-compute has a use-after-free in some host call implementations

Impact

The implementation of the following functions were determined to include a use-after-free bug:

  • FetchEvent.client.tlsCipherOpensslName
  • FetchEvent.client.tlsProtocol
  • FetchEvent.client.tlsClientCertificate
  • FetchEvent.client.tlsJA3MD5
  • FetchEvent.client.tlsClientHello
  • CacheEntry.prototype.userMetadata of the fastly:cache subsystem
  • Device.lookup of the fastly:device subsystem

This bug could allow for an unintended data leak if the result of the preceding functions were sent anywhere else, and often results in a Compute service crash causing an HTTP 500 error to be returned. As all requests to Compute are isolated from one another, the only data at risk is data present for a single request.

Patches

This bug has been fixed in version 3.16.0 of the @fastly/js-compute package.

Workarounds

There are no workarounds for this bug, any use of the affected functions introduces the possibility of a data leak or crash in guest code.

Record
GHSA-mp3g-vpm9-9vqv
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:H
Weakness
CWE-416
Updated
2026-11-02
NVD 5.3

@fastly/js-compute is a JavaScript SDK and runtime for building Fastly Compute applications. The implementation of several functions were determined to include a use-after-free bug. This bug could allow for unintended data loss if the result of the preceding functions were sent anywhere else, and often results in a guest trap causing services to return a 500. This bug has been fixed in version 3.16.0 of the @fastly/js-compute package.

Record
CVE-2024-38375
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:H
Weakness
CWE-416
Updated
2026-11-02
OSV 5.3

@fastly/js-compute use-after-free in some host call implementations

@fastly/js-compute is a JavaScript SDK and runtime for building Fastly Compute applications. The implementation of several functions were determined to include a use-after-free bug. This bug could allow for unintended data loss if the result of the preceding functions were sent anywhere else, and often results in a guest trap causing services to return a 500. This bug has been fixed in version 3.16.0 of the @fastly/js-compute package.

Record
CVE-2024-38375
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:H
Weakness
CWE-416
Updated
2026-11-02
OSVGHSA-mp3g-vpm9-9vqv 5.3

@fastly/js-compute has a use-after-free in some host call implementations

Impact

The implementation of the following functions were determined to include a use-after-free bug:

  • FetchEvent.client.tlsCipherOpensslName
  • FetchEvent.client.tlsProtocol
  • FetchEvent.client.tlsClientCertificate
  • FetchEvent.client.tlsJA3MD5
  • FetchEvent.client.tlsClientHello
  • CacheEntry.prototype.userMetadata of the fastly:cache subsystem
  • Device.lookup of the fastly:device subsystem

This bug could allow for an unintended data leak if the result of the preceding functions were sent anywhere else, and often results in a Compute service crash causing an HTTP 500 error to be returned. As all requests to Compute are isolated from one another, the only data at risk is data present for a single request.

Patches

This bug has been fixed in version 3.16.0 of the @fastly/js-compute package.

Workarounds

There are no workarounds for this bug, any use of the affected functions introduces the possibility of a data leak or crash in guest code.

Record
GHSA-mp3g-vpm9-9vqv
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:H
Weakness
CWE-416
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
@fastly/js-compute
npm
 3.0.0 up to 3.16.0
3.16.0

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-38375 is a medium vulnerability (CVSS 5.3) in Fastly Js-compute-runtime, published June 26, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 18th percentile. Fixed in @fastly/js-compute 3.16.0.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open