QuickJS vulnerabilities
We track 6 vulnerabilities in QuickJS products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on November 5, 2025.
Latest QuickJS vulnerabilities
- 7.8 High severity
QuickJS: Out-of-bounds Read
A weakness has been identified in QuickJS up to eb2c89087def1829ed99630cb14b549d7a98408c. This affects the function js_array_buffer_slice of the file quickjs.c. This manipulation causes buffer over-read. The attack is restricted to local execution. The exploit
- 8.8 High severity
QuickJS: Integer Overflow or Wraparound
A vulnerability exists in the QuickJS engine's BigInt string parsing logic (js_bigint_from_string) when attempting to create a BigInt from a string with an excessively large number of digits. The function calculates the necessary number of bits (n_bits) requir
- 8.8 High severity
QuickJS: Integer Underflow (Wrap or Wraparound)
An integer overflow vulnerability exists in the QuickJS regular expression engine (libregexp) due to an inconsistent representation of the bytecode buffer size. * The regular expression bytecode is stored in a DynBuf structure, which correctly uses a $\text{si
- 8.8 High severity
QuickJS: Incorrect Type Conversion or Cast
A type confusion vulnerability exists in the handling of the string addition (+) operation within the QuickJS engine. * The code first checks if the left-hand operand is a string. * It then attempts to convert the right-hand operand to a primitive value using
- 8.8 High severity
QuickJS: Use After Free
A Use-After-Free (UAF) vulnerability exists in the QuickJS engine's standard library when iterating over the global list of unhandled rejected promises (ts->rejected_promise_list). * The function js_std_promise_rejection_check attempts to iterate over the reje
- 8.8 High severity
QuickJS: Use After Free
In quickjs, in js_print_object, when printing an array, the function first fetches the array length and then loops over it. The issue is, printing a value is not side-effect free. An attacker-defined callback could run during js_print_value, during which the a