Quickjs CVE-2025-69653

A use-after-free in QuickJS's quickjs-libc standard library lets JavaScript code corrupt heap memory from inside the int

Use-after-free in QuickJS object-printing routines can corrupt memory when an attacker-influenced Array, Map, or Set is

QuickJS commit 2788d71 was discovered to contain a stack-overflow via the component js_proxy_isArray at quickjs.c. Rated

Heap out-of-bounds write in QuickJS's BigInt string parser can corrupt memory when an embedding application converts an

Integer overflow in QuickJS's libregexp bytecode accounting can become an out-of-bounds write when a crafted recursive r

Type confusion in QuickJS's handling of the string addition (+) operation allows local attackers to trigger out-of-bound

Information disclosure in QuickJS occurs through a floating-point precision error in TypedArray.prototype.indexOf() when

An out-of-bounds heap read in QuickJS's BigInt-to-string conversion (js_bigint_to_string1) lets script-controlled BigInt

Heap out-of-bounds write in QuickJS's bytecode deserializer (JS_ReadFunctionTag) lets a crafted serialized blob corrupt

quickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a heap-based buffer overfl

quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-based buffer

Heap-based buffer overflow in QuickJS up to version 0.11.0 within the js_typed_array_constructor function allows unauthe