Threats tagged 'ghsa-48fx-7fjq-qgg4'

QuickJS-NG versions prior to 0.16.0 have a memory leak vulnerability in the js_atomics_store() function. This flaw occurs when the function fails to free a converted value upon returning a RangeError. An attacker running JavaScript can exploit this by repeatedly calling Atomics.store with a crafted valueOf that detaches or shrinks the buffer, leading to heap memory exhaustion and denial of service.