Vulnerability in Demergent-labs Azle
CVE-2025-29776
Azle is a WebAssembly runtime for TypeScript and JavaScript on ICP. Calling `setTimer` in Azle versions `0.27.0`, `0.28.0`, and `0.29.0` causes an immediate infinite loop of timers to be executed on the canister, each timer attempting to c…
EPSS: 0.003 (26.8th percentile) — read the EPSS interpretation.
Affected products
- Demergent-labs Azle — versions >= 0.27.0, < 0.30.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-29776?
- CVE-2025-29776 is a vulnerability in Demergent-labs Azle, classified under Loop with Unreachable Exit Condition (Infinite Loop). Published 2025-03-14.
- Is CVE-2025-29776 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.