Heap Buffer Overflow in QuickJS: Critical Vulnerability Detected
Summary
OSV-2025-346: Heap-buffer-overflow in JS_CallInternal. Affects quickjs versions >= 0a6160d7b3290710daf2dbeaba73d4d50e93b684, < 1021e3c7297cbe1f5e5f3ebbc6ee7a25b4095d52. Fixed in 1021e3c7297cbe1f5e5f3ebbc6ee7a25b4095d52. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
QuickJS is a lightweight and embeddable JavaScript engine designed for performance and efficiency. It allows developers to run JavaScript code in various environments, making it a popular choice for applications requiring scripting capabilities. However, like any software, QuickJS is susceptible to vulnerabilities that can compromise its integrity and the security of applications that depend on it.
Vulnerability Detail
The vulnerability identified as OSV-2025-346 is a heap buffer overflow occurring in the JS_CallInternal function of QuickJS. This issue arises from improper memory handling, leading to potential crashes or exploitation by attackers. The vulnerability was reported through OSS-Fuzz, indicating its severity and the need for immediate attention. If exploited, this could allow unauthorized access to memory, potentially leading to arbitrary code execution.
How To Fix
Minimum fixed version
1021e3c7297cbe1f5e5f3ebbc6ee7a25b4095d52
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using the affected functions until the package is updated. However, this may limit the functionality of your application. It is advisable to monitor the situation and apply the patch as soon as it is available.
Conclusion
The heap buffer overflow vulnerability in QuickJS poses a significant risk to applications utilizing this JavaScript engine. It is crucial to update to the latest patched version to mitigate potential threats. Regular monitoring and proactive management of dependencies can help maintain the security of your software.
See every vulnerability recorded for quickjs →
FAQ
A heap buffer overflow is a type of vulnerability that occurs when a program writes more data to a buffer located on the heap than it can hold, potentially overwriting adjacent memory.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to analyze your manifest file without needing to sign up.
Exploiting this vulnerability could lead to application crashes, unauthorized access to sensitive data, or arbitrary code execution, compromising the security of your application.
Yes, tools like Vulert can monitor your open-source dependencies in real-time for vulnerabilities using just your manifest file, ensuring you stay informed about potential risks.
If an immediate update is not possible, consider implementing temporary workarounds and closely monitoring the situation until you can apply the necessary patches.
References
Related vulnerabilities
Recent vulnerabilities recorded for quickjs.
