CVE-2024-13903

CVE-2024-13903 affects quickjs-ng QuickJS up to 0.8.0. The vulnerability targets the JS_GetRuntime function in quickjs.c (component qjs), enabling a stack-based buffer overflow. The issue can be exploited remotely. Upgrade to version 0.9.0 to address the vulnerability; the patch is identified by ...

CVE-2025-46687

CVE-2025-46687 affects quickjs-ng up to 0.9.0. A missing length check in JS_ReadString can cause a heap-based buffer overflow, impacting QuickJS builds before 2025-04-26. This vulnerability is echoed across multiple sources (NVD, OSV, Debian/Ubuntu advisories and Nessus context), confirming the i...