Executive brief
QuickJS is a small and embeddable JavaScript engine used by developers to run JavaScript within various applications. A vulnerability has been identified where a specially crafted JavaScript file can cause the engine to crash unexpectedly. This results in a denial-of-service, potentially stopping the application or service that relies on the engine from functioning.
Technical details
A Reachable Assertion (CWE-617) vulnerability exists in the QuickJS JavaScript engine within the gc_decref_child function in quickjs.c. The issue is triggered when the qjs interpreter processes a crafted JavaScript module using the '-m' command-line option. During the garbage collection process, the engine fails an internal assertion, resulting in a SIGABRT and subsequent process termination. This vulnerability allows an attacker to cause a denial-of-service (DoS) by providing malicious JavaScript code to be executed by the engine. The issue was fixed in commit 1dbba8a88eaa40d15a8a9b70bb1a0b8fb5b552e6.
Affected products
- QuickJS Project QuickJS 2025-09-13 up to (excluding) 2025-12-11
Timeline
- 2025-12-11: patched: Fixed in commit 1dbba8a88eaa40d15a8a9b70bb1a0b8fb5b552e6
- 2026-03-06: disclosed: CVE published to NVD