---
id: CVE-2024-43367
aliases:
  - RUSTSEC-2024-0444
  - GHSA-f67q-wr6w-23jq
title: >-
  Uncaught exception when transitioning the state of `AsyncGenerator` objects
  from within a property getter of `then`
summary: >-
  Uncaught exception when transitioning the state of `AsyncGenerator` objects
  from within a property getter of `then`
severity: high
cvss: 8.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H'
vendor: boa_engine
product: boa_engine
ecosystem: rust
affected:
  - 'boa_engine >= 0.16.0, < 0.19.0'
patched:
  - boa_engine 0.19.0
published: '2024-08-14'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T18:00:06.811772530Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2024-0444'
references:
  - url: 'https://crates.io/crates/boa_engine'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2024-0444.html'
  - url: >-
      https://github.com/boa-dev/boa/commit/69ea2f52ed976934bff588d6b566bae01be313f7
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-43357'
  - url: >-
      https://github.com/boa-dev/boa/commit/69ea2f52ed976934bff588d6b566bae01be313f7
tags:
  - osv
  - rust
epss: 0.00597
epssPercentile: 0.48367
ingestedAt: '2026-10-13T11:45:30.174Z'
---

## Overview

A wrong assumption made when handling ECMAScript's AsyncGenerator operations
can cause an uncaught exception on certain scripts.

## Details

Boa's implementation of AsyncGenerator makes the assumption that the state of
an AsyncGenerator object cannot change while resolving a promise created by
methods of AsyncGenerator such as %AsyncGeneratorPrototype%.next,
%AsyncGeneratorPrototype%.return, or %AsyncGeneratorPrototype%.throw.

However, a carefully constructed code could trigger a state transition from
a getter method for the promise's then property, which causes the engine to
fail an assertion of this assumption, causing an uncaught exception. This
could be used to create a Denial Of Service attack in applications that
run arbitrary ECMAScript code provided by an external user.

## Patches

Version 0.19.0 is patched to correctly handle this case.

## Workarounds

Users unable to upgrade to the patched version would want to use
std::panic::catch_unwind to ensure any exceptions caused by the
engine don't impact the availability of the main application.

## Affected packages

- `boa_engine >= 0.16.0, < 0.19.0`

## Remediation

Upgrade to a patched release:

- `boa_engine 0.19.0`