Medium

@fastly/js-compute has a use-after-free in some host call implementations

Disclosed: 26.06.2024
Updated: 11.10.2026 10:22

Impact

The implementation of the following functions were determined to include a use-after-free bug:

FetchEvent.client.tlsCipherOpensslName
FetchEvent.client.tlsProtocol
FetchEvent.client.tlsClientCertificate
FetchEvent.client.tlsJA3MD5
FetchEvent.client.tlsClientHello
CacheEntry.prototype.userMetadata of the fastly:cache subsystem
Device.lookup of the fastly:device subsystem

This bug could allow for an unintended data leak if the result of the preceding functions were sent anywhere else, and often results in a Compute service crash causing an HTTP 500 error to be returned. As all requests to Compute are isolated from one another, the only data at risk is data present for a single request.

Patches

This bug has been fixed in version 3.16.0 of the @fastly/js-compute package.

Workarounds

There are no workarounds for this bug, any use of the affected functions introduces the possibility of a data leak or crash in guest code.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
npm package	@fastly/js-compute	>= 3.0.0, < 3.16.0	3.16.0

References

CVSS score 5.3/10

CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:H
Weakness (CWE): CWE-416
Platform: npm
Package: @fastly/js-compute
Disclosed: 26.06.2024
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-mp3g-vpm9-9vqv - CC BY 4.0

Vulnerability history: @fastly/js-compute

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 2
First → latest: 09.2022 06.2024
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

High 1
Medium 1

Disclosures per year

2022: 1
2023: 0
2024: 1
2025: 0
2026: 0

26.06.2024

@fastly/js-compute has a use-after-free in some host call implementations this entry

Medium · 5.3 CVE-2024-38375 >= 3.0.0, < 3.16.0 3.16.0
20.09.2022

Fastly Compute@Edge JS Runtime has fixed random number seed during compilation

High · 7.5 CVE-2022-39218 >= 0.4.0, < 0.5.3 0.5.3

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application