Heap-Use-After-Free Vulnerability in QuickJS: Critical Memory Management Flaw
Summary
OSV-2025-326: Heap-use-after-free in __JS_FreeValueRT. Affects quickjs versions >= be06b3e92b77a343adefa49a4b29e1ad523014ea, < 11d076fac6691da27df021872cdb12ec44d022e6. Fixed in 11d076fac6691da27df021872cdb12ec44d022e6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
QuickJS is a lightweight and embeddable JavaScript engine designed for performance and efficiency. It supports modern JavaScript features and is often used in applications requiring a scripting engine. However, like many software packages, it is susceptible to vulnerabilities that can compromise its integrity and security. The specific vulnerability in question relates to improper memory management, leading to potential exploitation through heap-use-after-free scenarios.
Vulnerability Detail
The vulnerability identified as OSV-2025-326 is a heap-use-after-free issue occurring in the __JS_FreeValueRT function of QuickJS. This flaw arises when the memory allocated for certain objects is freed while still being referenced, leading to potential crashes or arbitrary code execution. The vulnerability was reported through OSS-Fuzz, highlighting a crash state that indicates a write operation to freed memory, which can be exploited by attackers to manipulate the program's execution flow.
How To Fix
Minimum fixed version
11d076fac6691da27df021872cdb12ec44d022e6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is strongly recommended to update to the patched version to mitigate risks.
Conclusion
The heap-use-after-free vulnerability in QuickJS poses significant risks to applications utilizing this JavaScript engine. It is crucial for developers to update to the patched version to safeguard their applications against potential exploitation. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for quickjs →
FAQ
A heap-use-after-free vulnerability occurs when a program continues to use memory after it has been freed, which can lead to crashes or exploitation by attackers.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check if your application is affected without any signup.
Exploitation of this vulnerability can lead to application crashes, data corruption, or even arbitrary code execution, compromising the security of the application.
Yes, users should update to the version fixed in commit 11d076fac6691da27df021872cdb12ec44d022e6 to ensure they are not affected by this vulnerability.
If an immediate update is not possible, consider isolating the application from untrusted inputs and monitoring for unusual behavior until the update can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for quickjs.
