Skip to main content
VulnerabilityPublished

Quickjs: Heap-use-after-free

Affects quickjsSource GCVE Database

0
Severity
High

Rated High by Threat Radar's AI analysis

Patch
Available – fixed in fcbf5ea2a63510f35f9ab2baadd59781be16a167

Data as of 4 Nov 2026, 18:52 UTC

What to do

Upgrade quickjs to fcbf5ea2a63510f35f9ab2baadd59781be16a167.

Affected software

ProductAffectedFixed in
OSS-Fuzzquickjspkg:generic/quickjsOther threatsAffected
  • >=1e19893c82fe150db60f2464e4eeab2b663499d4 <fcbf5ea2a63510f35f9ab2baadd59781be16a167
Fixed in
  • fcbf5ea2a63510f35f9ab2baadd59781be16a167

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A patch is available and has been applied in commit fcbf5ea2a63510f35f9ab2baadd59781be16a167. Users of QuickJS should update to the fixed version to remediate this vulnerability.

Description

A heap-use-after-free vulnerability was identified in QuickJS within the JS_DefineProperty function. This issue was reported by OSS-Fuzz and involves a read operation on freed heap memory, which can lead to undefined behavior or potential memory corruption.

References

Community reviews

Loading reviews…