Executive brief
QuickJS is a small, embeddable JavaScript engine used in various software applications to execute scripts. A vulnerability exists where a specially crafted JavaScript file can cause the engine to crash when running under low memory constraints. This results in a denial of service, potentially causing the application using the engine to stop responding or shut down unexpectedly.
Technical details
A denial of service vulnerability exists in the QuickJS 'qjs' interpreter (release 2025-09-13). When the interpreter is executed with the '-m' option and a low memory limit, a crafted JavaScript input can trigger an out-of-memory (OOM) condition. While the engine correctly identifies the OOM error, it fails to fully release the Garbage Collector (GC) object list during runtime cleanup. This leads to an assertion failure in 'JS_FreeRuntime' (specifically 'list_empty(&rt->gc_obj_list)') and a subsequent SIGABRT. The issue was fixed in commit fcd33c1afa7b3028531f53cd1190a3877454f6b3.
Affected products
- Fabrice Bellard QuickJS 2025-09-13 through 2025-12-11
Timeline
- 2025-12-10: disclosed: Issue reported on GitHub
- 2025-12-11: patched: Fixed in commit fcd33c1afa7b3028531f53cd1190a3877454f6b3
- 2026-03-06: advisory: CVE published to NVD