WebAssembly Runtime Vulnerability in Azle Affected Versions
CVE-2025-29776

8.7HIGH

Key Information:

Vendor
Demergent-labs
Status
Azle
Vendor
CVE Published:
14 March 2025

Summary

In specific versions of Azle, a WebAssembly runtime for TypeScript and JavaScript on the Internet Computer (ICP), a flaw with the setTimer function causes an infinite loop of timer executions. This issue results in each timer attempting to clean up the global state from the previous timer, ultimately leading to resource exhaustion. Users operating Azle versions 0.27.0, 0.28.0, and 0.29.0 are advised to upgrade to version 0.30.0 to mitigate this vulnerability. Alternatively, if a canister is trapped in the infinite loop, it can be upgraded to clear all timers and resolve the issue. Visit the provided references for further details and mitigation steps.

Affected Version(s)

azle >= 0.27.0, < 0.30.0

References

https://github.com/demergent-labs/azle/security/advisorie...
x_refsource_CONFIRM
https://github.com/demergent-labs/azle/releases/tag/0.30.0
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.