CVE-2024-13903: 
NixOS vulnerability analysis and mitigation

A vulnerability has been identified in quickjs-ng QuickJS versions up to 0.8.0, affecting the JS_GetRuntime function in the quickjs.c file of the qjs component. The vulnerability was discovered on March 21, 2025, and is tracked as CVE-2024-13903. This stack-based buffer overflow vulnerability can be exploited remotely (NVD, VulDB Entry).

The vulnerability is classified as a stack-based buffer overflow (CWE-121) and has received a CVSS v3.1 base score of 7.5 (HIGH) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The issue manifests in the JS_GetRuntime function when handling recursive calls, which can lead to stack overflow conditions as demonstrated by proof-of-concept code (NVD, GitHub Issue).

The vulnerability primarily affects the availability of the system. When successfully exploited, it can cause a stack overflow condition, potentially leading to application crashes or denial of service. The vulnerability does not appear to impact confidentiality or integrity of the system (VulDB Entry).

The vulnerability has been fixed in QuickJS version 0.9.0. Users are strongly recommended to upgrade to this version. The fix is implemented in patch 99c02eb45170775a9a679c32b45dd4000ea67aff, which addresses the stack limit handling in ASan builds (GitHub Release, GitHub Commit).