CVE-2025-71470 · Runtime
NO FIX YET · SEE WHAT TO DO
MicroQuickJS (mquickjs) before commit 99eed3f raises exceptions in JS_Call() without updating the stack and frame pointers, so building a backtrace reads stale frames. An attacker who supplies JavaScript that calls a non-function value can crash the engine, causing denial of service.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only applications that embed MicroQuickJS (mquickjs) before commit 99eed3f and execute JavaScript that an attacker can supply. The sources do not give a released version number, so the fixed reference is the commit itself. Teams that run only trusted scripts or do not embed the engine can skip it.
Not affected if engine-not-embedded, no-untrusted-js
Who cares embedded-javascript, microquickjs, mquickjs
99eed3f; builds from before that commit are the ones described.Upgrade to a commit at or after 99eed3f, per the linked patch.
MicroQuickJS (mquickjs) before commit 99eed3f contains an out-of-bounds read vulnerability because JS_Call() raises exceptions during frame setup without updating ctx->sp and ctx->fp. Attackers can supply JavaScript that calls a non-function value, causing build_backtrace() to walk stale frame pointers and crash the engine for denial of service.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.