QuickJS Project vulnerabilities
We track 3 vulnerabilities in QuickJS Project products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on March 6, 2026.
Latest QuickJS Project vulnerabilities
- 7.5 High severity
Quickjs: Uncontrolled Resource Consumption
A crafted JavaScript input executed with the QuickJS release 2025-09-13, fixed in commit fcd33c1afa7b3028531f53cd1190a3877454f6b3 (2025-12-11),`qjs` interpreter using the `-m` option and a low memory limit can cause an out-of-memory condition followed by an as
- 8.4 High severity
QuickJS: Incorrect Calculation of Buffer Size
quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected.
- 7.8 High severity
QuickJS: Allocation of Resources Without Limits or Throttling
quickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected.