GHSA-jp52-chwg-2p9p: QuickJS-NG before 0.16.0 Heap Buffer Overflow via Proxy ownKeys Enumeration

Published Nov 2, 2026

Updated

QuickJS-NG before 0.16.0 contains an integer overflow in jsproxygetownpropertynames() in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the allocation size, causing crashes or potential code execution.

Event History

Nov 2, 2026

CVE Published

via OSV·02:29 PM

Data Sourced

via OSV·02:29 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

QuickJS-NG versions before 0.16.0 are affected on 32-bit hosts. The described allocation-size wrap occurs specifically in the 32-bit environment.

What does an attacker need to exploit this issue?

An attacker needs the ability to run JavaScript in the affected QuickJS-NG instance. They can use a Proxy ownKeys trap that returns a large array-like object.

What is the potential impact of successful exploitation?

The integer overflow can cause a heap buffer overflow in js_proxy_get_own_property_names(). This can lead to crashes or potential code execution.

GHSA-jp52-chwg-2p9p: QuickJS-NG before 0.16.0 Heap Buffer Overflow via Proxy ownKeys Enumeration

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the potential impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the potential impact of successful exploitation?