CVE-2021-46336

What it actually does

Triggers an assertion failure in the JavaScript class body parser, resulting in an application crash when processing certain class literal constructs.

Why it matters to the business

Applications relying on the affected JavaScript engine can be forced offline by untrusted input, causing service disruption without data loss or code execution.

How an attack unfolds

An attacker supplies JavaScript containing a class literal that violates internal parser state checks, causing the assertion to fail and the process to terminate.

How to fix it

Upgrade to a newer release of JerryScript that resolves the parser assertion; if no update is available, isolate or sandbox the engine and reject untrusted class-containing scripts.

How to confirm the fix worked

Test the parser with the original triggering class literal after any update and confirm the process no longer terminates with the assertion message.

Typical attack path

1. Identify an application embedding the vulnerable JavaScript engine
2. Prepare a minimal JavaScript snippet with a class literal that triggers the parser assertion
3. Deliver the snippet via file, network, or API input accepted by the application
4. Observe immediate crash and denial of service

How to detect it

Search application and system logs for the exact assertion failure string from the parser module and for abrupt process terminations when handling JavaScript input.

What your security team should do

• Inventory all products and services that embed JerryScript
• Apply available updates or implement strict input filtering for JavaScript class syntax
• Monitor crash logs for the parser assertion string
• Consider replacing the engine with a maintained alternative if updates remain unavailable