Heap-use-after-free in quickjs

quickjs Updated 02 Oct 2025

Summary

30/12/2023

Disclosed on

HIGH

Severity

Yes i

Fix available

High

Severity

Not published

CVSS Score

OSV-2023-1372: Heap-use-after-free in JS_NewObjectFromShape. Affects quickjs versions >= 7414e5f67f9a404f3cf91ffa69d0c93bf46d099e, < 3c2cfabfc74e8af1f21db93884ed1ad9b6388a8c. Fixed in 3c2cfabfc74e8af1f21db93884ed1ad9b6388a8c. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

quickjs is an open-source JavaScript engine that is designed to be small and efficient. It provides a JavaScript interpreter and a set of built-in objects, allowing developers to embed JavaScript in their applications. The vulnerability in quickjs arises from a heap-use-after-free issue in the JS_NewObjectFromShape function. This function is responsible for creating a new JavaScript object from a given shape. The vulnerability can be triggered during the parsing of a template, specifically in the js_parse_template and js_parse_postfix_expr functions.

Vulnerability Detail

The heap-use-after-free vulnerability in quickjs can lead to a crash due to a write of 8 bytes to a freed memory region. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial of service. The vulnerability was discovered through an OSS-Fuzz report and has been assigned a severity rating of HIGH. The crash occurs in the JS_NewObjectFromShape function, which is called during the parsing of a template. This vulnerability can be traced back to the commit 7414e5f67f9a404f3cf91ffa69d0c93bf46d099e in the quickjs GitHub repository.

How To Fix

Minimum fixed version

3c2cfabfc74e8af1f21db93884ed1ad9b6388a8c

This is the first release that contains the fix.

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

At the moment, there is no known workaround for this vulnerability. It is advisable to update the quickjs package to the latest version that includes the necessary fixes.

Conclusion

The heap-use-after-free vulnerability in quickjs can have serious security implications. It is crucial to update the quickjs package to the latest version that includes the necessary patches. Regularly updating packages helps ensure that the latest security fixes are applied. For further support on vulnerability remediation, you can reach out to DevNack.com.

See every vulnerability recorded for quickjs →