Issues

• Use-after-free of a generator object: closures created before OP_initial_yield do not keep the generator alive

  quickjs-ng/quickjs#1910 · Filter by author connorshea opened on Nov 11, 2026

• get_closure_var() failure is ignored in resolve_scope_var, emitting get_var_ref 65535 and an out-of-bounds var_refs[] read

  quickjs-ng/quickjs#1909 · Filter by author connorshea opened on Nov 11, 2026

• Direct eval in a parameter list with no named parameters reads vardefs[] far out of bounds

  quickjs-ng/quickjs#1908 · Filter by author connorshea opened on Nov 11, 2026

• Use-after-free in Map.prototype.clear / Set.prototype.clear when clearing a record frees the next one

  quickjs-ng/quickjs#1907 · Filter by author connorshea opened on Nov 11, 2026

• Object spread of a string primitive ({ ..."ab" }) gives {}

  quickjs-ng/quickjs#1903 · Filter by author trackoor opened on Nov 9, 2026

• Security audit of QuickJS-ng

  quickjs-ng/quickjs#1902 · Filter by author andreasrosdal opened on Nov 9, 2026
  1

• AsyncDisposableStack.disposeAsync() disposal chain can be hijacked by script, causing skipped and fd leaks

  quickjs-ng/quickjs#1901 · Filter by author she1p opened on Nov 9, 2026

• Unchecked register index in deserialized RegExp bytecode leads to heap out-of-bounds read/write

  quickjs-ng/quickjs#1900 · Filter by author she1p opened on Nov 8, 2026

• Use After Free While Iterating the Unhandled-Promise Rejection List: printing a rejection reason re-enters the host tracker and frees the node being iterated

  quickjs-ng/quickjs#1899 · Filter by author she1p opened on Nov 8, 2026

• JS_GetTypedArrayBuffer / JS_GetUint8Array report a stale length for length-tracking views after ArrayBuffer.prototype.resize()

  quickjs-ng/quickjs#1894 · Filter by author gritzko opened on Nov 5, 2026

• Memory leak: a property key made from a slice of a large string leaks the parent string on every lookup

  quickjs-ng/quickjs#1893 · Filter by author gritzko opened on Nov 5, 2026

• [Feature request] Add js-ffi-cross

  quickjs-ng/quickjs#1891 · Filter by author ghost opened on Nov 4, 2026

• Array iterator, Proxy ownKeys and RegExp @@replace read length with ToUint32 instead of ToLength

  quickjs-ng/quickjs#1890 · Filter by author trackoor opened on Nov 4, 2026

• Template objects read back from bytecode are not frozen (length stays writable)

  quickjs-ng/quickjs#1888 · Filter by author trackoor opened on Nov 4, 2026

• / after a template literal inside parentheses is scanned as a regexp: (a = 8 / 2) => a is a SyntaxError

  quickjs-ng/quickjs#1886 · Filter by author trackoor opened on Nov 4, 2026

• continue to an outer label of a label set (a: b: for (…) continue a;) is rejected with "break/continue label not found"

  quickjs-ng/quickjs#1884 · Filter by author trackoor opened on Nov 4, 2026

• Object.defineProperty past the end of a non-extensible array fails but still updates length

  quickjs-ng/quickjs#1882 · Filter by author trackoor opened on Nov 4, 2026

• TypedArray.prototype.with: wrong result or error type when the buffer shrinks or detaches during argument conversion

  quickjs-ng/quickjs#1878 · Filter by author trackoor opened on Nov 4, 2026

• continue inside a for (let …) body skips the per-iteration copy, so closures see later values

  quickjs-ng/quickjs#1875 · Filter by author trackoor opened on Nov 4, 2026

• Version 0.18.0 of qjs-windows-x86_64.exe hangs on 64 bit windows7

  quickjs-ng/quickjs#1868 · Filter by author mhogomchungu opened on Nov 2, 2026
  10

• Captured variable count truncation causes out-of-bounds r/w + generator use-after-free

  quickjs-ng/quickjs#1865 · Filter by author sergiointel opened on Nov 1, 2026

• Bring back JS_READ_OBJ_ROM_DATA

  enhancement
  quickjs-ng/quickjs#1864 · Filter by author bnoordhuis opened on Oct 31, 2026
  3

• Different result .toString() of a function between interpreted qjs and compiled

  quickjs-ng/quickjs#1863 · Filter by author mardon86 opened on Oct 31, 2026
  4

• More native loops never consult the interrupt handler (TypedArray, String, JSON, change-array-by-copy, and some harder cases)

  quickjs-ng/quickjs#1856 · Filter by author philkunz opened on Oct 28, 2026
  1

• JS_SetPropertyInternal2 loses the value when a lazy property on the prototype runs out of memory

  quickjs-ng/quickjs#1852 · Filter by author liustack opened on Oct 27, 2026