Uninitialized Value Vulnerability in QuickJS: JS_DefineProperty Crash Risk
Summary
OSV-2025-321: Use-of-uninitialized-value in JS_DefineProperty. Affects quickjs versions >= be06b3e92b77a343adefa49a4b29e1ad523014ea, < 11d076fac6691da27df021872cdb12ec44d022e6. Fixed in 11d076fac6691da27df021872cdb12ec44d022e6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
QuickJS is a lightweight and embeddable JavaScript engine designed for performance and efficiency. It supports modern JavaScript features and is often used in environments where resource constraints are a concern. However, like any software, it is susceptible to vulnerabilities that can compromise its stability and security. The vulnerability in question arises from the use of uninitialized values in the JS_DefineProperty function, which can lead to crashes and unpredictable behavior.
Vulnerability Detail
The vulnerability identified as OSV-2025-321 is a use-of-uninitialized-value issue in the JS_DefineProperty function of QuickJS. This flaw was reported through OSS-Fuzz, a service that finds security vulnerabilities in open-source software. When an uninitialized value is used, it can lead to crashes, making the software unreliable. The vulnerability is particularly concerning as it can be exploited in scenarios where the JavaScript engine is used in critical applications, potentially leading to denial of service or other unintended consequences.
How To Fix
Minimum fixed version
11d076fac6691da27df021872cdb12ec44d022e6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the JS_DefineProperty function until they have updated to the patched version. Additionally, thorough testing of applications using QuickJS can help identify any potential issues related to this vulnerability before applying the fix.
Conclusion
The OSV-2025-321 vulnerability in QuickJS poses a significant risk due to the use of uninitialized values in the JS_DefineProperty function. Users are strongly encouraged to update to the patched version to mitigate the risk of crashes and ensure the stability of their applications. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for quickjs →
FAQ
The vulnerability is a use-of-uninitialized-value issue in the JS_DefineProperty function, which can lead to crashes.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
The vulnerability can lead to application crashes and instability, particularly in environments where QuickJS is used for critical tasks.
Yes, a patch is available. Users should update to the version fixed in commit 11d076fac6691da27df021872cdb12ec44d022e6.
As a temporary measure, avoid using the JS_DefineProperty function and conduct thorough testing of your applications.
References
Related vulnerabilities
Recent vulnerabilities recorded for quickjs.
