CVE-2025-46688

quickjs-ng through 0.9.0 has an incorrect size calculation in JSReadBigInt for a BigInt, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected...

Prototype Pollution

json-bigint is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto to cause a denial of service condition...