Quickjs-ng vulnerabilities

Products

• Quickjs 16
• Quickjs-ng 3

Newest

• quickjs-ng QuickJS-NG before 0.16.0 Memory Leak via Atomics.store CVE-2026-120440 Fix available 6.9 MediumNovember 2, 2026
• quickjs-ng QuickJS-NG before 0.16.0 Heap Buffer Overflow via TypedArray.prototype.sort CVE-2026-120439 Fix available 8.3 HighNovember 2, 2026
• quickjs-ng QuickJS-NG before 0.16.0 Heap Buffer Overflow via Proxy ownKeys Enumeration CVE-2026-120438 Fix available 8.5 HighNovember 2, 2026
• quickjs-ng quickjs quickjs-ng quickjs quickjs.c js_iterator_concat_return use after free CVE-2026-3979 4.8 MediumMarch 12, 2026
• quickjs-ng quickjs quickjs-ng quickjs quickjs.c js_typed_array_constructor_ta heap-based overflow CVE-2026-1145 Fix available 5.3 MediumJanuary 19, 2026
• quickjs-ng quickjs quickjs-ng quickjs Atomics Ops quickjs.c use after free CVE-2026-1144 Fix available 5.3 MediumJanuary 19, 2026
• quickjs-ng quickjs quickjs-ng quickjs quickjs.c js_typed_array_sort heap-based overflow CVE-2026-0822 Fix available 5.3 MediumJanuary 10, 2026
• quickjs-ng quickjs quickjs-ng quickjs quickjs.c js_typed_array_constructor heap-based overflow CVE-2026-0821 Fix available 6.9 MediumJanuary 10, 2026
• bellard quickjs QuickJS quickjs.c js_array_buffer_slice buffer over-read CVE-2025-12745 4.8 MediumNovember 5, 2025
• quickjs Integer overflow in js_bigint_from_string in QuickJS CVE-2025-62496 7.1 HighOctober 16, 2025
• quickjs Type confusion in string addition in QuickJS CVE-2025-62495 7.1 HighOctober 16, 2025
• quickjs Type confusion in string addition in QuickJS CVE-2025-62494 7.1 HighOctober 16, 2025
• quickjs Heap out-of-bounds read in js_bigint_to_string1 in QuickJS CVE-2025-62493 5.9 MediumOctober 16, 2025
• quickjs Heap out-of-bounds read in js_typed_array_indexOf in QuickJS CVE-2025-62492 5.9 MediumOctober 16, 2025
• quickjs Use-after-free in js_std_promise_rejection_check in QuickJS CVE-2025-62491 8.8 HighOctober 16, 2025
• quickjs Use-after-free in js_print_object in QuickJS CVE-2025-62490 8.8 HighOctober 16, 2025
• quickjs project quickjs quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading... CVE-2025-46688 Fix available 5.6 MediumApril 27, 2025
• bellard quickjs quickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a... CVE-2025-46687 Fix available 5.6 MediumApril 27, 2025
• quickjs-ng quickjs quickjs-ng QuickJS qjs quickjs.c JS_GetRuntime stack-based overflow CVE-2024-13903 5.3 MediumMarch 21, 2025