What is GHSA-jww9-7qmq-6hv5?

GHSA-jww9-7qmq-6hv5 is a security advisory published by GitHub Security Advisories with Critical severity. QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JS_ReadFunctionTag().

Which CVE IDs does GHSA-jww9-7qmq-6hv5 cover?

GHSA-jww9-7qmq-6hv5 covers the following CVE IDs: CVE-2026-88378. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jww9-7qmq-6hv5?

GHSA-jww9-7qmq-6hv5 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

GHSA-jww9-7qmq-6hv5CriticalCVSS 9.8

QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JS_ReadFunctionTag().

Vendor

GitHub Security Advisories

Published

September 24, 2026

Last Modified

September 29, 2026

🔗 CVE IDs covered (1)

CVE-2026-88378 →

📋 Description

QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JS_ReadFunctionTag().

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-88378
https://github.com/bellard/quickjs/issues/549
https://github.com/bellard/quickjs/pull/553
https://github.com/bellard/quickjs/pull/553/changes/42526037cfc0b2a94a875c0de0f4bbeaf597a542
https://github.com/advisories/GHSA-jww9-7qmq-6hv5