QuickJS · weakness class
Memory Corruption
12 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 12 is a mark on the map. Named now: 1 to 12, most at risk first.
- Buffer Overflow vulnerability in quickjs.c in QuickJS, allows remote attackers to cause denial of service. This issue is resolved in the 2020-07-05 release.
- QuickJS commit 2788d71 was discovered to contain a stack-overflow via the component js_proxy_isArray at quickjs.c.
- QuickJS before c4cdd61 has a build_for_in_iterator NULL pointer dereference because of an erroneous lexical scope of "this" with eval.
- Type confusion in string addition in QuickJS
- Integer overflow in js_bigint_from_string in QuickJS
- Type confusion in string addition in QuickJS
- Use-after-free in js_std_promise_rejection_check in QuickJS
- Use-after-free in js_print_object in QuickJS
- Heap out-of-bounds read in js_typed_array_indexOf in QuickJS
- Heap out-of-bounds read in js_bigint_to_string1 in QuickJS
- QuickJS before 7414e5f has a quickjs.h JS_FreeValueRT use-after-free because of incorrect garbage collection of async functions with closures.
- quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected.
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.