CVE-2024-33263

What it actually does

Assertion failure triggered inside JS_FreeRuntime during JavaScript runtime teardown, resulting in an immediate process crash and denial of service.

Why it matters to the business

Applications embedding the affected QuickJS engine can be forced offline with minimal attacker effort, causing temporary service disruption; low EPSS and absence from KEV indicate limited real-world urgency despite the 883-day-old disclosure.

How an attack unfolds

An attacker supplies JavaScript code or data that reaches the runtime-free path under conditions that violate an internal assertion, causing the hosting process to terminate.

How to fix it

Upgrade QuickJS to a revision that removes the assertion failure in JS_FreeRuntime; until a fixed version is available, isolate untrusted JavaScript execution and implement process-level restart or watchdog mechanisms.

How to confirm the fix worked

Execute the original crashing JavaScript snippet against the updated runtime and confirm the process no longer terminates with an assertion failure; monitor runtime logs for absence of the prior crash signature.

Typical attack path

1. Identify an application or service that embeds QuickJS commit 3b45d15 or nearby revisions.
2. Craft or supply input that exercises JavaScript execution paths leading to JS_FreeRuntime.
3. Trigger the assertion failure to crash the process and achieve denial of service.

How to detect it

Review application and system logs for sudden process terminations or assertion-failure messages around JS_FreeRuntime calls; correlate with JavaScript execution events from untrusted sources.

What your security team should do

• Track upstream QuickJS commits for a corrective change to JS_FreeRuntime and schedule upgrade.
• Add process monitoring and automatic restart for any service using QuickJS.
• Restrict untrusted JavaScript execution to least-privilege sandboxes.