CVE-2023-48183

The QuickJS JavaScript engine (versions prior to c4cdd61 ) is vulnerable to a NULL pointer dereference caused by an erroneous lexical scope of "this" with eval . This flaw can be exploited to cause a crash, leading to a denial of service (DoS) , or potentially allow for arbitrary code execution b...

CVE-2023-31922

CVE-2023-31922 affects QuickJS, specifically the js_proxy_isArray path in quickjs.c, where a stack overflow can trigger a crash. The issue is tied to commit 2788d71. Public docs indicate a DoS/crash impact but do not provide exploitation details. Remediation mentioned in the sources includes upgr...

CVE-2020-22876

CVE-2020-22876 relates to a buffer overflow in QuickJS (source: quickjs.c). The vulnerability allows remote denial of service via a crafted input and is mitigated by a fix released on 2020-07-05. Affected component is the QuickJS engine; root cause is a buffer overflow in quickjs.c leading to mem...

CVE-2025-69654

The QuickJS JavaScript engine (versions 2025-09-13 through 2025-12-11 ) is vulnerable to a denial of service via a crafted JavaScript input. When the qjs interpreter is used with the -m option and a low memory limit, it can trigger an out-of-memory (OOM) condition. This causes an assertion failur...