Vulnerability HighRUSTSEC-2024-0444 · boa_engine

RUSTSEC-2024-0444: Uncaught exception when transitioning the state of `AsyncGenerator` objects from within a property getter of `then`

Short answerA security vulnerability in the boa_engine crate: Uncaught exception when transitioning the state of `AsyncGenerator` objects from within a property getter of `then`. High severity (CVSS 8.6). Fixed in 0.19.0: update to a fixed version.

Crate	boa_engine
Type	Vulnerability (denial-of-service)
Affected versions	From 0.16.0 before 0.19.0.
Fixed in	0.19.0
Severity	High, CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Published	2024-08-14
Last changed	2026-10-12
Also known as	CVE-2024-43367, GHSA-f67q-wr6w-23jq

What to do

See which version you have: cargo tree -i boa_engine (it also shows which of your dependencies pulls it in).
Update within your version requirement: cargo update -p boa_engine. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example boa_engine = "0.19.0") or update the dependency that pulls it in.
Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

A wrong assumption made when handling ECMAScript's AsyncGenerator operations can cause an uncaught exception on certain scripts.

Details

Boa's implementation of AsyncGenerator makes the assumption that the state of an AsyncGenerator object cannot change while resolving a promise created by methods of AsyncGenerator such as %AsyncGeneratorPrototype%.next, %AsyncGeneratorPrototype%.return, or %AsyncGeneratorPrototype%.throw.

However, a carefully constructed code could trigger a state transition from a getter method for the promise's then property, which causes the engine to fail an assertion of this assumption, causing an uncaught exception. This could be used to create a Denial Of Service attack in applications that run arbitrary ECMAScript code provided by an external user.

Patches

Version 0.19.0 is patched to correctly handle this case.

Workarounds

Users unable to upgrade to the patched version would want to use std::panic::catch_unwind to ensure any exceptions caused by the engine don't impact the availability of the main application.

References

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Up next

Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →

Also worth your time

All Rust security advisoriesBrowse

Did this answer your question?