CVE-2023-48184

What it actually does

Incorrect garbage collection of async functions with closures triggers a use-after-free condition in JS_FreeValueRT, resulting in a dangling pointer and potential memory corruption within the QuickJS engine.

Why it matters to the business

Applications relying on QuickJS may experience instability, crashes, or limited exploitation that compromises script execution integrity, increasing operational risk in embedded, serverless, or browser-like environments with high prevalence of JavaScript dependencies.

How an attack unfolds

An attacker crafts JavaScript containing async functions that capture closures, supplies it to the QuickJS runtime, and triggers execution paths that force garbage collection at the wrong time, leaving a freed object referenced and enabling memory manipulation.

How to fix it

Upgrade QuickJS to a build containing commit 7414e5f or later that corrects garbage collection handling for async functions with closures.

How to confirm the fix worked

Confirm the runtime commit or version includes 7414e5f, execute targeted test cases with async closures under memory pressure, and review engine source for the corrected collection logic.

Typical attack path

1. Supply malicious JavaScript payload to QuickJS runtime
2. Invoke async functions that utilize closures
3. Induce garbage collection during execution
4. Reference the dangling pointer created by incorrect collection
5. Leverage use-after-free for corruption or control-flow influence

How to detect it

Monitor process logs and crash reports for QuickJS memory errors or segmentation faults during JavaScript execution involving async patterns; inspect heap dumps for unexpected freed-object accesses.

What your security team should do

• Apply the 7414e5f fix across all QuickJS deployments immediately given the 906-day exposure window
• Inventory downstream packages and dependents that embed QuickJS
• Add regression tests for async function closure scenarios in continuous integration