QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JSReadFunctionTag().
In quickjs, in jsprintobject, when printing an array, the function first fetches the array length and then loops over it. The issue is, printing a value is not side-effect free. An attacker-defined callback could run during jsprintvalue, during which the array could get resized and len1 become out of bounds. This results in a use-after-free.A second instance occurs in the same function during printing of a map or set objects. The code iterates over ms->records list, but once again, elements could be removed from the list during jsprintvalue call.
A vulnerability exists in the QuickJS engine's BigInt string parsing logic (jsbigintfromstring) when attempting to create a BigInt from a string with an excessively large number of digits.
The function calculates the necessary number of bits (nbits) required to store the BigInt using the formula:
$$\text{n\bits} = (\text{n\digits} \times 27 + 7) / 8 \quad (\text{for radix 10})$$
For large input strings (e.g., $79,536,432$ digits or more for base 10), the intermediate calculation $(\text{n\digits} \times 27 + 7)$ exceeds the maximum value of a standard signed 32-bit integer, resulting in an Integer Overflow.
The resulting nbits value becomes unexpectedly small or even negative due to this wrap-around.
This flawed nbits is then used to compute nlimbs, the number of memory "limbs" needed for the BigInt object. Since nbits is too small, the calculated nlimbs is also significantly underestimated.
The function proceeds to allocate a JSBigInt object using this underestimated nlimbs.
When the function later attempts to write the actual BigInt data into the allocated object, the small buffer size is quickly exceeded, leading to a Heap Out-of-Bounds Write as data is written past the end of the allocated r->tab array.
A crafted JavaScript input can trigger an internal assertion failure in QuickJS release 2025-09-13, fixed in commit 1dbba8a88eaa40d15a8a9b70bb1a0b8fb5b552e6 (2025-12-11), in file gcdecrefchild in quickjs.c, when executed with the qjs interpreter using the -m option. This leads to an abort (SIGABRT) during garbage collection and causes a denial-of-service.
A vulnerability stemming from floating-point arithmetic precision errors exists in the QuickJS engine's implementation of TypedArray.prototype.indexOf() when a negative fromIndex argument is supplied.
The fromIndex argument (read as a double variable, $d$) is used to calculate the starting position for the search.
If d is negative, the index is calculated relative to the end of the array by adding the array's length (len) to d:
$$d{new} = d + \text{len}$$
Due to the inherent limitations of floating-point arithmetic, if the negative value $d$ is extremely small (e.g., $-1 \times 10^{-20}$), the addition $d + \text{len}$ can result in a loss of precision, yielding an outcome that is exactly equal to $\text{len}$.
The result is then converted to an integer index $k$: $k = \text{len}$.
The search function proceeds to read array elements starting from index $k$. Since valid indices are $0$ to $\text{len}-1$, starting the read at index $\text{len}$ is one element past the end of the array.
This allows an attacker to cause an Out-of-Bounds Read of one element immediately following the buffer. While the scope of this read is small (one element), it can potentially lead to Information Disclosure of adjacent memory contents, depending on the execution environment.
Last updated 15 April 2025
A weakness has been identified in QuickJS up to eb2c89087def1829ed99630cb14b549d7a98408c. This affects the function jsarraybufferslice of the file quickjs.c. This manipulation causes buffer over-read. The attack is restricted to local execution. The exploit has been made available to the public and could be exploited. This product adopts a rolling release strategy to maintain continuous delivery Patch name: c6fe5a98fd3ef3b7064e6e0145dfebfe12449fea. To fix this issue, it is recommended to deploy a patch.