CVE-2024-43367 – Boa has an uncaught exception when transitioning the state of `AsyncGenerator` objects

https://notcve.org/view.php?id=CVE-2024-43367

15 Aug 2024 — Boa is an embeddable and experimental Javascript engine written in Rust. Starting in version 0.16 and prior to version 0.19.0, a wrong assumption made when handling ECMAScript's `AsyncGenerator` operations can cause an uncaught exception on certain scripts. Boa's implementation of `AsyncGenerator` makes the assumption that the state of an `AsyncGenerator` object cannot change while resolving a promise created by methods of `AsyncGenerator` such as `%AsyncGeneratorPrototype%.next`, `%AsyncGeneratorPrototype%... • https://github.com/boa-dev/boa/security/advisories/GHSA-f67q-wr6w-23jq • CWE-248: Uncaught Exception •