Heap Buffer Overflow Vulnerability in QuickJS Package
Summary
OSV-2025-541: Heap-buffer-overflow in js_create_function. Affects quickjs versions >= f1b1c000c2a05972c1834f306786d2b41f767ef5, < fa628f8c523ecac8ce560c081411e91fcaba2d20. Fixed in fa628f8c523ecac8ce560c081411e91fcaba2d20. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
QuickJS is a lightweight and embeddable JavaScript engine developed by Fabrice Bellard. It is designed for performance and small footprint, making it suitable for various applications, including IoT devices and web browsers. However, like many software packages, QuickJS is susceptible to vulnerabilities that can compromise its functionality and security.
Vulnerability Detail
The vulnerability identified in QuickJS is a heap buffer overflow that occurs during the execution of JavaScript functions. This issue arises from improper memory management in the js_create_function function, leading to potential crashes and exploitation. The vulnerability was reported through OSS-Fuzz, highlighting its severity and the need for immediate attention to prevent possible exploitation in production environments.
How To Fix
Minimum fixed version
fa628f8c523ecac8ce560c081411e91fcaba2d20
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the specific JavaScript functions that trigger the vulnerability until the package is updated. Monitor the application for any unusual behavior that may indicate exploitation attempts.
Conclusion
The heap buffer overflow vulnerability in the QuickJS package poses a significant risk to applications utilizing this JavaScript engine. It is crucial to update to the patched version to mitigate potential exploitation. Users are encouraged to monitor their applications and utilize tools like Vulert for ongoing vulnerability management.
See every vulnerability recorded for quickjs →
FAQ
A heap buffer overflow occurs when a program writes more data to a buffer located on the heap than it can hold, potentially overwriting adjacent memory and leading to crashes or security vulnerabilities.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By simply using a manifest file like package-lock.json, you can check if your application is affected without needing to access the code.
If exploited, this vulnerability could lead to application crashes, unauthorized access to sensitive data, or remote code execution, compromising the security of the entire system.
Yes, you can temporarily avoid using the affected functions and monitor your application for any unusual behavior that may indicate an exploitation attempt.
Detailed information about this vulnerability can be found in the OSS-Fuzz report at https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=430091578.
References
Related vulnerabilities
Recent vulnerabilities recorded for quickjs.
