We no longer accept private security reports nor issue CVEs. Please file bug reports in the issue tracker.

Bytecode hardening is out of scope. QuickJS bytecode is not designed for adversarial input. Loading untrusted bytecode (e.g. via JS_ReadObject with JS_READ_OBJ_BYTECODE) is equivalent to executing untrusted native code, and crashes, memory corruption, or sandbox escapes resulting from malformed or malicious bytecode are not considered security vulnerabilities. Only load bytecode you produced yourself or obtained from a trusted source. See the documentation for JS_READ_OBJ_BYTECODE and JS_READ_OBJ_SAB for details.