Heap Buffer Overflow Vulnerability in QuickJS Package
Summary
OSV-2025-524: Heap-buffer-overflow in JS_CallInternal. Affects quickjs versions >= f1b1c000c2a05972c1834f306786d2b41f767ef5, < 20d2b404af65edc5d66ee6f11a59f930ea3d1b88. Fixed in 20d2b404af65edc5d66ee6f11a59f930ea3d1b88. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
QuickJS is a lightweight and embeddable JavaScript engine developed by Fabrice Bellard. It is designed for performance and small footprint, making it suitable for various applications, including IoT devices and web browsers. However, like many software packages, QuickJS is susceptible to vulnerabilities that can affect its stability and security.
Vulnerability Detail
The vulnerability identified in QuickJS is a heap buffer overflow that occurs during the execution of JavaScript functions. Specifically, the issue arises in the JS_CallInternal function, which can lead to a crash when an asynchronous function is resumed. This vulnerability can be exploited to read beyond allocated memory, potentially allowing an attacker to execute arbitrary code or cause a denial of service. The vulnerability was reported through OSS-Fuzz, highlighting its significance in maintaining software integrity.
How To Fix
Minimum fixed version
20d2b404af65edc5d66ee6f11a59f930ea3d1b88
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid using asynchronous functions that may trigger the vulnerability until the package is updated. This can help mitigate the risk of exploitation while a permanent fix is being implemented.
Conclusion
The heap buffer overflow vulnerability in QuickJS poses a significant risk to applications utilizing this JavaScript engine. It is crucial for developers to update to the patched version to ensure the security and stability of their applications. Utilizing tools like Vulert can aid in monitoring for such vulnerabilities effectively.
See every vulnerability recorded for quickjs →
FAQ
A heap buffer overflow occurs when a program writes more data to a buffer located on the heap than it can hold, leading to memory corruption and potential security vulnerabilities.
Exploitation of this vulnerability can lead to application crashes, data corruption, or even remote code execution, compromising the security of the application and its users.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By using the Vulert playground, you can check if your application is affected by this vulnerability without any signup.
If immediate updates are not possible, consider implementing the suggested workaround by avoiding the use of asynchronous functions that may trigger the vulnerability.
More details can be found in the OSS-Fuzz report linked in the vulnerability details, which provides insights into the crash type and state.
References
Related vulnerabilities
Recent vulnerabilities recorded for quickjs.
