Quickjs-ng vulnerabilities
We track 7 vulnerabilities in Quickjs-ng products across 2 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on November 2, 2026.
Latest Quickjs-ng vulnerabilities
- 7.0 High severity
QuickJS-NG: Integer Overflow or Wraparound
QuickJS-NG before 0.16.0 contains an integer overflow in js_typed_array_sort() in quickjs.c that allows attackers to cause a heap buffer overflow on 32-bit hosts. Attackers who can run JavaScript can call TypedArray.prototype.sort with a comparator on a typed
- 7.8 High severity
QuickJS-NG: Integer Overflow or Wraparound
QuickJS-NG before 0.16.0 contains an integer overflow in js_proxy_get_own_property_names() in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the
- 8.8 High severity
quickjs: Improper Restriction of Operations within the Bounds of a Memory Buffer
A flaw has been found in quickjs-ng quickjs up to 0.11.0. Affected by this vulnerability is the function js_typed_array_constructor_ta of the file quickjs.c. This manipulation causes heap-based buffer overflow. The attack is possible to be carried out remotely
- 8.8 High severity
quickjs: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was detected in quickjs-ng quickjs up to 0.11.0. Affected is an unknown function of the file quickjs.c of the component Atomics Ops Handler. The manipulation results in use after free. The attack can be executed remotely. The exploit is now pub
- 8.8 High severity
quickjs: Out-of-bounds Write
A vulnerability was identified in quickjs-ng quickjs up to 0.11.0. This issue affects the function js_typed_array_sort of the file quickjs.c. The manipulation leads to heap-based buffer overflow. Remote exploitation of the attack is possible. The exploit is pu
- 9.8 Critical severity
quickjs: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was determined in quickjs-ng quickjs up to 0.11.0. This vulnerability affects the function js_typed_array_constructor of the file quickjs.c. Executing a manipulation can lead to heap-based buffer overflow. The attack may be launched remotely. T
- 7.5 High severity
QuickJS: Out-of-bounds Write
A vulnerability was found in quickjs-ng QuickJS up to 0.8.0. It has been declared as problematic. Affected by this vulnerability is the function JS_GetRuntime of the file quickjs.c of the component qjs. The manipulation leads to stack-based buffer overflow. Th