Use-of-Uninitialized-Value Vulnerability in QuickJS
Summary
OSV-2025-1016: Use-of-uninitialized-value in js_create_function. Affects quickjs versions >= 24379bf53c30b35151f345318d850bac49219288. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
QuickJS is a lightweight and embeddable JavaScript engine designed for performance and efficiency. It supports modern JavaScript features and is often used in applications where a small footprint is essential. However, like any software, it can be susceptible to vulnerabilities that may compromise its functionality and security.
Vulnerability Detail
The vulnerability identified as 'Use-of-uninitialized-value' occurs in the js_create_function function within QuickJS. This issue was reported through OSS-Fuzz, indicating that the function can lead to crashes when uninitialized values are used during execution. The crash state is linked to the internal evaluation processes of JavaScript objects, which can result in unexpected behavior or application crashes. If exploited, this vulnerability could allow an attacker to disrupt the normal operation of applications using QuickJS, leading to potential denial of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected function until a patch is applied. Additionally, ensure that all inputs to the js_create_function are properly initialized before use to mitigate the risk of encountering this vulnerability.
Conclusion
The 'Use-of-Uninitialized-Value' vulnerability in QuickJS poses a risk of application crashes and potential denial of service. It is crucial for users to update to the latest version of QuickJS to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for quickjs →
FAQ
The vulnerability is a use-of-uninitialized-value issue that can lead to application crashes.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, updating to the latest version of QuickJS will include the necessary patches to fix this vulnerability.
Exploitation of this vulnerability can lead to application crashes and denial of service, affecting the overall user experience.
As a temporary measure, ensure that all inputs to the affected function are initialized properly to reduce the risk of encountering the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for quickjs.
