CVE-2021-46351

What it actually does

Assertion failure in ecma_builtin_date_prototype_dispatch_set triggers a crash when processing certain date operations in JerryScript 3.0.0.

Why it matters to the business

Applications or services using the affected JavaScript engine can be forced offline, interrupting normal operations until restart.

How an attack unfolds

An attacker supplies crafted JavaScript that invokes the date prototype setter, hitting the failing assertion and terminating the process. Public exploit code exists, though the vulnerability has not appeared in known campaigns.

How to fix it

Upgrade JerryScript to a version containing the corrected date prototype handling; if no patched release is available, apply vendor patches or isolate the engine from untrusted inputs.

How to confirm the fix worked

Confirm the JerryScript version is newer than 3.0.0 and that the assertion at ecma-builtin-date-prototype.c:421 no longer fires under the same test cases.

Typical attack path

1. Identify a target application embedding JerryScript 3.0.0
2. Craft or obtain JavaScript input that exercises Date.prototype setters
3. Deliver the input via local execution or user-interaction path
4. Trigger the assertion failure to crash the engine

How to detect it

Search application and system logs for the exact assertion failure string referencing ecma_builtin_date_prototype_dispatch_set and ecma-builtin-date-prototype.c:421; correlate with process crashes around date-handling code.

• Assertion 'local_tza == ecma_date_local_time_zone_adjustment (date_value)' failed at /jerry-core/ecma/builtin-objects/ecma-builtin-date-prototype.c(ecma_builtin_date_prototype_dispatch_set):421

What your security team should do

• Inventory all deployments using JerryScript and flag any still on 3.0.0
• Prioritize upgrade or input sanitization for internet-facing or multi-tenant workloads
• Monitor public exploit repositories for new samples targeting this assertion