CVE-2025-29776 Overview
CVE-2025-29776 is an infinite loop vulnerability in Azle, a WebAssembly runtime for TypeScript and JavaScript on the Internet Computer Protocol (ICP). Any valid invocation of the setTimer function in affected versions triggers an immediate infinite loop of timer executions on the canister. Each timer attempts to clean up the global state of the previous timer, perpetuating the loop. The flaw renders affected canisters unresponsive until they are upgraded. The issue is tracked under [CWE-835] (Loop with Unreachable Exit Condition).
Critical Impact
A single call to setTimer exhausts canister execution resources, producing a denial-of-service condition that halts legitimate workloads on the Internet Computer canister.
Affected Products
- Azle version 0.27.0
- Azle version 0.28.0
- Azle version 0.29.0
Discovery Timeline
- 2025-03-14 - CVE-2025-29776 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-29776
Vulnerability Analysis
Azle provides a WebAssembly runtime that lets developers build ICP canisters using TypeScript and JavaScript. The setTimer API schedules deferred execution of a callback within the canister. In versions 0.27.0 through 0.29.0, the timer scheduling logic interacts incorrectly with global state cleanup routines. Invoking setTimer queues a timer that attempts to clean up the global state of the previous timer. That cleanup operation schedules another timer, which repeats the process indefinitely.
The result is an unbounded loop of timer executions. The canister consumes cycles continuously and cannot make forward progress on user-facing methods. Because setTimer is a standard API exposed to canister developers, any deployment that uses the function on an affected Azle version is impacted on first invocation.
Root Cause
The defect is a logic error in the timer lifecycle. The cleanup routine that runs at timer completion enqueues a successor timer rather than terminating the chain. The exit condition for the loop is unreachable, matching the [CWE-835] classification. The behavior is deterministic and reproducible with any valid setTimer argument.
Attack Vector
The vulnerability is triggered by normal program flow rather than crafted attacker input. Any code path that reaches setTimer activates the loop. A network-reachable canister method that internally schedules a timer can be invoked by any caller, which exhausts the canister's compute budget and produces a denial of service. See the GitHub Security Advisory GHSA-xc76-5pf9-mx8m for the vendor analysis.
Detection Methods for CVE-2025-29776
Indicators of Compromise
- Canister CPU and cycle consumption remains pinned at maximum after a method that calls setTimer is invoked.
- Canister method calls time out or return unresponsive after a single setTimer invocation.
- ICP replica logs show continuous timer execution events originating from the same canister.
Detection Strategies
- Inventory all canisters built with Azle and identify those using versions 0.27.0, 0.28.0, or 0.29.0.
- Audit source code for calls to setTimer in canisters running affected Azle versions.
- Run integration tests in a controlled environment that exercise setTimer code paths to confirm whether the loop is triggered.
Monitoring Recommendations
- Track cycle burn rate per canister and alert on sustained spikes following deployment or upgrade events.
- Monitor canister method latency and timeout rates as proxies for runtime stalls.
- Watch the Azle GitHub releases and security advisories feed for future runtime issues.
How to Mitigate CVE-2025-29776
Immediate Actions Required
- Upgrade Azle to version 0.30.0 or later before deploying or upgrading any canister that uses setTimer.
- For canisters currently stuck in the infinite loop, perform a canister upgrade to clear pending timers and break the loop.
- Remove or gate calls to setTimer in production canisters until the upgrade to 0.30.0 is completed.
Patch Information
The issue is resolved in Azle 0.30.0. Release notes and the corrected timer handling are available at the Azle 0.30.0 release page. The GHSA-xc76-5pf9-mx8m advisory documents the fix and the affected version range.
Workarounds
- Upgrade the affected canister to clear queued timers, which terminates the infinite loop without requiring an Azle version change.
- Refactor canister code to avoid setTimer until the Azle runtime is upgraded to 0.30.0.
- Maintain a tested canister upgrade path so operators can recover quickly if the loop is triggered in production.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
