Quickjs Ng
Monthly
Heap buffer overflow in QuickJS-NG before 0.16.0 allows JavaScript code executed by the embedding application to drive an integer overflow inside js_typed_array_sort(), corrupting heap memory on 32-bit hosts and crashing the process, with limited potential for code execution (vendor CVSS 4.0 score 8.3; independently assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H). Only 32-bit builds are affected, and exploitation requires a typed array near 2^30 elements - roughly a 1 GB ArrayBuffer - to be allocated successfully, followed by a .sort() call with a comparator; 64-bit builds do not overflow the size computation. No public exploit code was identified at time of analysis, and the vulnerability has not been confirmed as actively exploited (CISA KEV).
Heap buffer overflow in QuickJS-NG releases before 0.16.0 gives JavaScript code a path to memory corruption on 32-bit hosts: a Proxy whose ownKeys trap reports an array-like result with a length near 2^32 wraps a 32-bit property count in js_proxy_get_own_property_names(), so the buffer allocated for enumerated keys is far smaller than the number of entries later copied into it. Only 32-bit deployments are affected - the GHSA states explicitly that on 64-bit platforms the allocation size is correct and the overflow does not occur - and the attacker must already be able to execute JavaScript inside the embedding host (CVSS 4.0 AV:L/PR:L), with no user interaction required once script runs. Successful exploitation corrupts heap metadata and can crash the host or potentially lead to code execution; there is no CISA KEV listing and no public exploit identified at time of analysis, though the upstream fix commit includes regression tests that demonstrate the trigger. Vendor-released patch: 0.16.0.
Heap memory exhaustion in QuickJS-NG versions before 0.16.0 lets JavaScript executed by an embedding host drain the process one BigInt allocation at a time: each Atomics.store() call on a BigInt64Array or BigUint64Array whose backing buffer is detached (ab.transfer()) or shrunk (ab.resize(0)) during value coercion leaks the converted BigInt instead of freeing it. An attacker able to run scripts inside a QuickJS-NG host - server-side script runners, plugin sandboxes, IoT firmware - can loop that pattern to cause denial of service in long-running processes; there is no confidentiality or integrity impact and no code execution. Vendor CVSS 4.0 is 6.9 with availability impact Low only, the priority label is 'this_month' rather than emergency, and no public exploit code or CISA KEV entry was identified at time of analysis; the fix ships in release 0.16.0.
Heap-based buffer overflow in QuickJS up to version 0.11.0 within the js_typed_array_constructor_ta function allows remote attackers to corrupt memory and potentially achieve code execution with user interaction. Public exploit code exists for this vulnerability, increasing practical attack risk. A patch is available and should be applied immediately.
Use-after-free in QuickJS up to version 0.11.0 within the Atomics Ops Handler allows remote attackers to trigger memory corruption without authentication. Public exploit code exists for this vulnerability, enabling potential information disclosure or denial of service. A patch is available and should be applied immediately.
Heap-based buffer overflow in QuickJS up to version 0.11.0 within the js_typed_array_sort function allows remote attackers to corrupt memory and potentially achieve code execution with minimal user interaction. Public exploit code exists for this vulnerability. Users should apply the available patch (commit 53eefbcd695165a3bd8c584813b472cb4a69fbf5) to remediate the risk.
Heap-based buffer overflow in QuickJS up to version 0.11.0 within the js_typed_array_constructor function allows unauthenticated remote attackers to corrupt memory and potentially execute arbitrary code. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. Affected users should apply patch c5d80831e51e48a83eab16ea867be87f091783c5 immediately.
quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-based buffer overflow. Rated medium severity (CVSS 5.6), this vulnerability is no authentication required. Public exploit code available.
quickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a heap-based buffer overflow. Rated medium severity (CVSS 5.6), this vulnerability is no authentication required. Public exploit code available.
A vulnerability was found in quickjs-ng QuickJS up to 0.8.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Heap buffer overflow in QuickJS-NG before 0.16.0 allows JavaScript code executed by the embedding application to drive an integer overflow inside js_typed_array_sort(), corrupting heap memory on 32-bit hosts and crashing the process, with limited potential for code execution (vendor CVSS 4.0 score 8.3; independently assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H). Only 32-bit builds are affected, and exploitation requires a typed array near 2^30 elements - roughly a 1 GB ArrayBuffer - to be allocated successfully, followed by a .sort() call with a comparator; 64-bit builds do not overflow the size computation. No public exploit code was identified at time of analysis, and the vulnerability has not been confirmed as actively exploited (CISA KEV).
Heap buffer overflow in QuickJS-NG releases before 0.16.0 gives JavaScript code a path to memory corruption on 32-bit hosts: a Proxy whose ownKeys trap reports an array-like result with a length near 2^32 wraps a 32-bit property count in js_proxy_get_own_property_names(), so the buffer allocated for enumerated keys is far smaller than the number of entries later copied into it. Only 32-bit deployments are affected - the GHSA states explicitly that on 64-bit platforms the allocation size is correct and the overflow does not occur - and the attacker must already be able to execute JavaScript inside the embedding host (CVSS 4.0 AV:L/PR:L), with no user interaction required once script runs. Successful exploitation corrupts heap metadata and can crash the host or potentially lead to code execution; there is no CISA KEV listing and no public exploit identified at time of analysis, though the upstream fix commit includes regression tests that demonstrate the trigger. Vendor-released patch: 0.16.0.
Heap memory exhaustion in QuickJS-NG versions before 0.16.0 lets JavaScript executed by an embedding host drain the process one BigInt allocation at a time: each Atomics.store() call on a BigInt64Array or BigUint64Array whose backing buffer is detached (ab.transfer()) or shrunk (ab.resize(0)) during value coercion leaks the converted BigInt instead of freeing it. An attacker able to run scripts inside a QuickJS-NG host - server-side script runners, plugin sandboxes, IoT firmware - can loop that pattern to cause denial of service in long-running processes; there is no confidentiality or integrity impact and no code execution. Vendor CVSS 4.0 is 6.9 with availability impact Low only, the priority label is 'this_month' rather than emergency, and no public exploit code or CISA KEV entry was identified at time of analysis; the fix ships in release 0.16.0.
Heap-based buffer overflow in QuickJS up to version 0.11.0 within the js_typed_array_constructor_ta function allows remote attackers to corrupt memory and potentially achieve code execution with user interaction. Public exploit code exists for this vulnerability, increasing practical attack risk. A patch is available and should be applied immediately.
Use-after-free in QuickJS up to version 0.11.0 within the Atomics Ops Handler allows remote attackers to trigger memory corruption without authentication. Public exploit code exists for this vulnerability, enabling potential information disclosure or denial of service. A patch is available and should be applied immediately.
Heap-based buffer overflow in QuickJS up to version 0.11.0 within the js_typed_array_sort function allows remote attackers to corrupt memory and potentially achieve code execution with minimal user interaction. Public exploit code exists for this vulnerability. Users should apply the available patch (commit 53eefbcd695165a3bd8c584813b472cb4a69fbf5) to remediate the risk.
Heap-based buffer overflow in QuickJS up to version 0.11.0 within the js_typed_array_constructor function allows unauthenticated remote attackers to corrupt memory and potentially execute arbitrary code. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. Affected users should apply patch c5d80831e51e48a83eab16ea867be87f091783c5 immediately.
quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-based buffer overflow. Rated medium severity (CVSS 5.6), this vulnerability is no authentication required. Public exploit code available.
quickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a heap-based buffer overflow. Rated medium severity (CVSS 5.6), this vulnerability is no authentication required. Public exploit code available.
A vulnerability was found in quickjs-ng QuickJS up to 0.8.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.