@fastly/js-compute has a use-after-free in some host call implementations

Description

The implementation of the following functions were determined to include a use-after-free bug:

• FetchEvent.client.tlsCipherOpensslName
• FetchEvent.client.tlsProtocol
• FetchEvent.client.tlsClientCertificate
• FetchEvent.client.tlsJA3MD5
• FetchEvent.client.tlsClientHello
• CacheEntry.prototype.userMetadata of the fastly:cache subsystem
• `Device.

Recommendation

Update the @fastly/js-compute package to the latest compatible version. Followings are version details:

• Affected version(s): >= 3.0.0, < 3.16.0
• Patched version(s): 3.16.0

References

• GHSA-mp3g-vpm9-9vqv
• CVE-2024-38375
• CWE-416
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Fastly Compute@Edge JS Runtime has fixed random number seed during compilation - CVE-2022-39218
• Use-After-Free in puppeteer - CVE-2019-5786
• Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges - CVE-2026-50131
• Plate media plugins has a XSS in media embed element when using custom URL parsers - CVE-2024-40631

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@fastly/js-compute