CVE-2023-31922: 
NixOS vulnerability analysis and mitigation

CVE-2023-31922 was discovered in QuickJS commit 2788d71, involving a stack-overflow vulnerability in the js_proxy_isArray component at quickjs.c. The vulnerability was published on May 12, 2023, and affects the QuickJS JavaScript engine (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The issue is classified as CWE-787 (Out-of-bounds Write). The vulnerability manifests as a stack overflow condition when the js_proxy_isArray() function and the JS_IsArray() function enter into an infinite recursive call pattern (GitHub Issue).

The vulnerability can lead to a stack overflow condition, potentially causing the application to crash or become unresponsive. The CVSS scoring indicates that while there is no impact on confidentiality or integrity, there is a high impact on system availability (NVD).

The vulnerability can be triggered by creating a deeply nested Proxy object structure and calling Array.isArray() on it. A proof of concept exists that demonstrates the vulnerability by creating 131,072 nested Proxy objects (GitHub Issue).