Search
Find a vulnerability
Search criteria
6 vulnerabilities found for QuickJS-NG by quickjs-ng
CVE-2026-120440 (GCVE-0-2026-120440)
Vulnerability from nvd – Published: 2026-11-02 14:29 – Updated: 2026-11-02 17:33
VLAI
EPSS
VEX
Title
QuickJS-NG before 0.16.0 Memory Leak via Atomics.store
Summary
QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the converted value when returning a RangeError. Attackers running JavaScript can repeatedly call Atomics.store with a valueOf that detaches or shrinks the buffer to exhaust heap memory and cause denial of service.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 17:12 UTC
CWE
- CWE-401 - Missing Release of Memory after Effective Lifetime
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/quickjs-ng/quickjs/security/ad… | vendor-advisory |
| https://github.com/quickjs-ng/quickjs/commit/6295… | patch |
| https://github.com/quickjs-ng/quickjs/releases/ta… | release-notes |
| https://github.com/quickjs-ng/quickjs/blob/v0.15.… | technical-description |
| https://www.vulncheck.com/advisories/quickjs-ng-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| quickjs-ng | QuickJS-NG |
Affected:
0 , < 0.16.0
(semver)
cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:* |
Date Public
2026-07-31 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120440",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T17:12:52.060134Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T17:33:29.004Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/quickjs-ng/quickjs",
"product": "QuickJS-NG",
"repo": "https://github.com/quickjs-ng/quickjs",
"vendor": "quickjs-ng",
"versions": [
{
"lessThan": "0.16.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.16.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tristan Madani (Talence Security)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Sa\u00fal Ibarra Corretg\u00e9"
}
],
"datePublic": "2026-07-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the converted value when returning a RangeError. Attackers running JavaScript can repeatedly call Atomics.store with a valueOf that detaches or shrinks the buffer to exhaust heap memory and cause denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-401",
"description": "Missing Release of Memory after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:29:02.038Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-wm7w-r6qf-3c9w)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/quickjs-ng/quickjs/security/advisories/GHSA-wm7w-r6qf-3c9w"
},
{
"tags": [
"patch"
],
"url": "https://github.com/quickjs-ng/quickjs/commit/62951e1bc68711d37aad986ff84ef0fe17038a7e"
},
{
"name": "QuickJS-NG v0.16.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/quickjs-ng/quickjs/releases/tag/v0.16.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/quickjs-ng/quickjs/blob/v0.15.1/quickjs.c#L61154"
},
{
"name": "VulnCheck Advisory: QuickJS-NG before 0.16.0 Memory Leak via Atomics.store",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/quickjs-ng-before-0.16.0-memory-leak-via-atomics-store"
}
],
"title": "QuickJS-NG before 0.16.0 Memory Leak via Atomics.store",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-120440",
"datePublished": "2026-11-02T14:29:02.038Z",
"dateReserved": "2026-11-02T12:42:15.887Z",
"dateUpdated": "2026-11-02T17:33:29.004Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120439 (GCVE-0-2026-120439)
Vulnerability from nvd – Published: 2026-11-02 14:29 – Updated: 2026-11-02 14:29
VLAI
EPSS
VEX
Title
QuickJS-NG before 0.16.0 Heap Buffer Overflow via TypedArray.prototype.sort
Summary
QuickJS-NG before 0.16.0 contains an integer overflow in js_typed_array_sort() in quickjs.c that allows attackers to cause a heap buffer overflow on 32-bit hosts. Attackers who can run JavaScript can call TypedArray.prototype.sort with a comparator on a typed array near 2^30 elements, wrapping the allocation size and writing indices past the buffer to crash or potentially execute code.
Severity
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/quickjs-ng/quickjs/security/ad… | vendor-advisory |
| https://github.com/quickjs-ng/quickjs/commit/e93c… | patch |
| https://github.com/quickjs-ng/quickjs/releases/ta… | release-notes |
| https://github.com/quickjs-ng/quickjs/blob/v0.15.… | technical-description |
| https://www.vulncheck.com/advisories/quickjs-ng-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| quickjs-ng | QuickJS-NG |
Affected:
0 , < 0.16.0
(semver)
cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:* |
Date Public
2026-07-31 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/quickjs-ng/quickjs",
"product": "QuickJS-NG",
"repo": "https://github.com/quickjs-ng/quickjs",
"vendor": "quickjs-ng",
"versions": [
{
"lessThan": "0.16.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.16.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tristan Madani (Talence Security)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Sa\u00fal Ibarra Corretg\u00e9"
}
],
"datePublic": "2026-07-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "QuickJS-NG before 0.16.0 contains an integer overflow in js_typed_array_sort() in quickjs.c that allows attackers to cause a heap buffer overflow on 32-bit hosts. Attackers who can run JavaScript can call TypedArray.prototype.sort with a comparator on a typed array near 2^30 elements, wrapping the allocation size and writing indices past the buffer to crash or potentially execute code."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:29:01.345Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-9wv5-5cgr-grj6)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/quickjs-ng/quickjs/security/advisories/GHSA-9wv5-5cgr-grj6"
},
{
"tags": [
"patch"
],
"url": "https://github.com/quickjs-ng/quickjs/commit/e93cca611908e12b824ec85fbee6b31a5ee61568"
},
{
"name": "QuickJS-NG v0.16.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/quickjs-ng/quickjs/releases/tag/v0.16.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/quickjs-ng/quickjs/blob/v0.15.1/quickjs.c#L60032"
},
{
"name": "VulnCheck Advisory: QuickJS-NG before 0.16.0 Heap Buffer Overflow via TypedArray.prototype.sort",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/quickjs-ng-before-0.16.0-heap-buffer-overflow-via-typedarray-prototype-sort"
}
],
"title": "QuickJS-NG before 0.16.0 Heap Buffer Overflow via TypedArray.prototype.sort",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-120439",
"datePublished": "2026-11-02T14:29:01.345Z",
"dateReserved": "2026-11-02T12:42:15.449Z",
"dateUpdated": "2026-11-02T14:29:01.345Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120438 (GCVE-0-2026-120438)
Vulnerability from nvd – Published: 2026-11-02 14:29 – Updated: 2026-11-02 14:29
VLAI
EPSS
VEX
Title
QuickJS-NG before 0.16.0 Heap Buffer Overflow via Proxy ownKeys Enumeration
Summary
QuickJS-NG before 0.16.0 contains an integer overflow in js_proxy_get_own_property_names() in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the allocation size, causing crashes or potential code execution.
Severity
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/quickjs-ng/quickjs/security/ad… | vendor-advisory |
| https://github.com/quickjs-ng/quickjs/commit/2522… | patch |
| https://github.com/quickjs-ng/quickjs/releases/ta… | release-notes |
| https://github.com/quickjs-ng/quickjs/blob/v0.15.… | technical-description |
| https://www.vulncheck.com/advisories/quickjs-ng-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| quickjs-ng | QuickJS-NG |
Affected:
0 , < 0.16.0
(semver)
cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:* |
Date Public
2026-07-31 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/quickjs-ng/quickjs",
"product": "QuickJS-NG",
"repo": "https://github.com/quickjs-ng/quickjs",
"vendor": "quickjs-ng",
"versions": [
{
"lessThan": "0.16.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.16.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tristan Madani (Talence Security)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Sa\u00fal Ibarra Corretg\u00e9"
}
],
"datePublic": "2026-07-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "QuickJS-NG before 0.16.0 contains an integer overflow in js_proxy_get_own_property_names() in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the allocation size, causing crashes or potential code execution."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:29:00.633Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-jp52-chwg-2p9p)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/quickjs-ng/quickjs/security/advisories/GHSA-jp52-chwg-2p9p"
},
{
"tags": [
"patch"
],
"url": "https://github.com/quickjs-ng/quickjs/commit/252209d99cf112568160548bdcaa98d95e0d0068"
},
{
"name": "QuickJS-NG v0.16.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/quickjs-ng/quickjs/releases/tag/v0.16.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/quickjs-ng/quickjs/blob/v0.15.1/quickjs.c#L51509"
},
{
"name": "VulnCheck Advisory: QuickJS-NG before 0.16.0 Heap Buffer Overflow via Proxy ownKeys Enumeration",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/quickjs-ng-before-0.16.0-heap-buffer-overflow-via-proxy-ownkeys-enumeration"
}
],
"title": "QuickJS-NG before 0.16.0 Heap Buffer Overflow via Proxy ownKeys Enumeration",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-120438",
"datePublished": "2026-11-02T14:29:00.633Z",
"dateReserved": "2026-11-02T12:42:15.054Z",
"dateUpdated": "2026-11-02T14:29:00.633Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120440 (GCVE-0-2026-120440)
Vulnerability from cvelistv5 – Published: 2026-11-02 14:29 – Updated: 2026-11-02 17:33
VLAI
EPSS
VEX
Title
QuickJS-NG before 0.16.0 Memory Leak via Atomics.store
Summary
QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the converted value when returning a RangeError. Attackers running JavaScript can repeatedly call Atomics.store with a valueOf that detaches or shrinks the buffer to exhaust heap memory and cause denial of service.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 17:12 UTC
CWE
- CWE-401 - Missing Release of Memory after Effective Lifetime
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/quickjs-ng/quickjs/security/ad… | vendor-advisory |
| https://github.com/quickjs-ng/quickjs/commit/6295… | patch |
| https://github.com/quickjs-ng/quickjs/releases/ta… | release-notes |
| https://github.com/quickjs-ng/quickjs/blob/v0.15.… | technical-description |
| https://www.vulncheck.com/advisories/quickjs-ng-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| quickjs-ng | QuickJS-NG |
Affected:
0 , < 0.16.0
(semver)
cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:* |
Date Public
2026-07-31 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120440",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T17:12:52.060134Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T17:33:29.004Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/quickjs-ng/quickjs",
"product": "QuickJS-NG",
"repo": "https://github.com/quickjs-ng/quickjs",
"vendor": "quickjs-ng",
"versions": [
{
"lessThan": "0.16.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.16.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tristan Madani (Talence Security)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Sa\u00fal Ibarra Corretg\u00e9"
}
],
"datePublic": "2026-07-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the converted value when returning a RangeError. Attackers running JavaScript can repeatedly call Atomics.store with a valueOf that detaches or shrinks the buffer to exhaust heap memory and cause denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-401",
"description": "Missing Release of Memory after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:29:02.038Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-wm7w-r6qf-3c9w)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/quickjs-ng/quickjs/security/advisories/GHSA-wm7w-r6qf-3c9w"
},
{
"tags": [
"patch"
],
"url": "https://github.com/quickjs-ng/quickjs/commit/62951e1bc68711d37aad986ff84ef0fe17038a7e"
},
{
"name": "QuickJS-NG v0.16.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/quickjs-ng/quickjs/releases/tag/v0.16.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/quickjs-ng/quickjs/blob/v0.15.1/quickjs.c#L61154"
},
{
"name": "VulnCheck Advisory: QuickJS-NG before 0.16.0 Memory Leak via Atomics.store",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/quickjs-ng-before-0.16.0-memory-leak-via-atomics-store"
}
],
"title": "QuickJS-NG before 0.16.0 Memory Leak via Atomics.store",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-120440",
"datePublished": "2026-11-02T14:29:02.038Z",
"dateReserved": "2026-11-02T12:42:15.887Z",
"dateUpdated": "2026-11-02T17:33:29.004Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120439 (GCVE-0-2026-120439)
Vulnerability from cvelistv5 – Published: 2026-11-02 14:29 – Updated: 2026-11-02 14:29
VLAI
EPSS
VEX
Title
QuickJS-NG before 0.16.0 Heap Buffer Overflow via TypedArray.prototype.sort
Summary
QuickJS-NG before 0.16.0 contains an integer overflow in js_typed_array_sort() in quickjs.c that allows attackers to cause a heap buffer overflow on 32-bit hosts. Attackers who can run JavaScript can call TypedArray.prototype.sort with a comparator on a typed array near 2^30 elements, wrapping the allocation size and writing indices past the buffer to crash or potentially execute code.
Severity
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/quickjs-ng/quickjs/security/ad… | vendor-advisory |
| https://github.com/quickjs-ng/quickjs/commit/e93c… | patch |
| https://github.com/quickjs-ng/quickjs/releases/ta… | release-notes |
| https://github.com/quickjs-ng/quickjs/blob/v0.15.… | technical-description |
| https://www.vulncheck.com/advisories/quickjs-ng-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| quickjs-ng | QuickJS-NG |
Affected:
0 , < 0.16.0
(semver)
cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:* |
Date Public
2026-07-31 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/quickjs-ng/quickjs",
"product": "QuickJS-NG",
"repo": "https://github.com/quickjs-ng/quickjs",
"vendor": "quickjs-ng",
"versions": [
{
"lessThan": "0.16.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.16.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tristan Madani (Talence Security)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Sa\u00fal Ibarra Corretg\u00e9"
}
],
"datePublic": "2026-07-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "QuickJS-NG before 0.16.0 contains an integer overflow in js_typed_array_sort() in quickjs.c that allows attackers to cause a heap buffer overflow on 32-bit hosts. Attackers who can run JavaScript can call TypedArray.prototype.sort with a comparator on a typed array near 2^30 elements, wrapping the allocation size and writing indices past the buffer to crash or potentially execute code."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:29:01.345Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-9wv5-5cgr-grj6)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/quickjs-ng/quickjs/security/advisories/GHSA-9wv5-5cgr-grj6"
},
{
"tags": [
"patch"
],
"url": "https://github.com/quickjs-ng/quickjs/commit/e93cca611908e12b824ec85fbee6b31a5ee61568"
},
{
"name": "QuickJS-NG v0.16.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/quickjs-ng/quickjs/releases/tag/v0.16.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/quickjs-ng/quickjs/blob/v0.15.1/quickjs.c#L60032"
},
{
"name": "VulnCheck Advisory: QuickJS-NG before 0.16.0 Heap Buffer Overflow via TypedArray.prototype.sort",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/quickjs-ng-before-0.16.0-heap-buffer-overflow-via-typedarray-prototype-sort"
}
],
"title": "QuickJS-NG before 0.16.0 Heap Buffer Overflow via TypedArray.prototype.sort",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-120439",
"datePublished": "2026-11-02T14:29:01.345Z",
"dateReserved": "2026-11-02T12:42:15.449Z",
"dateUpdated": "2026-11-02T14:29:01.345Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120438 (GCVE-0-2026-120438)
Vulnerability from cvelistv5 – Published: 2026-11-02 14:29 – Updated: 2026-11-02 14:29
VLAI
EPSS
VEX
Title
QuickJS-NG before 0.16.0 Heap Buffer Overflow via Proxy ownKeys Enumeration
Summary
QuickJS-NG before 0.16.0 contains an integer overflow in js_proxy_get_own_property_names() in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the allocation size, causing crashes or potential code execution.
Severity
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/quickjs-ng/quickjs/security/ad… | vendor-advisory |
| https://github.com/quickjs-ng/quickjs/commit/2522… | patch |
| https://github.com/quickjs-ng/quickjs/releases/ta… | release-notes |
| https://github.com/quickjs-ng/quickjs/blob/v0.15.… | technical-description |
| https://www.vulncheck.com/advisories/quickjs-ng-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| quickjs-ng | QuickJS-NG |
Affected:
0 , < 0.16.0
(semver)
cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:* |
Date Public
2026-07-31 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/quickjs-ng/quickjs",
"product": "QuickJS-NG",
"repo": "https://github.com/quickjs-ng/quickjs",
"vendor": "quickjs-ng",
"versions": [
{
"lessThan": "0.16.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:quickjs_project:quickjs:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.16.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tristan Madani (Talence Security)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Sa\u00fal Ibarra Corretg\u00e9"
}
],
"datePublic": "2026-07-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "QuickJS-NG before 0.16.0 contains an integer overflow in js_proxy_get_own_property_names() in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the allocation size, causing crashes or potential code execution."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:29:00.633Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-jp52-chwg-2p9p)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/quickjs-ng/quickjs/security/advisories/GHSA-jp52-chwg-2p9p"
},
{
"tags": [
"patch"
],
"url": "https://github.com/quickjs-ng/quickjs/commit/252209d99cf112568160548bdcaa98d95e0d0068"
},
{
"name": "QuickJS-NG v0.16.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/quickjs-ng/quickjs/releases/tag/v0.16.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/quickjs-ng/quickjs/blob/v0.15.1/quickjs.c#L51509"
},
{
"name": "VulnCheck Advisory: QuickJS-NG before 0.16.0 Heap Buffer Overflow via Proxy ownKeys Enumeration",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/quickjs-ng-before-0.16.0-heap-buffer-overflow-via-proxy-ownkeys-enumeration"
}
],
"title": "QuickJS-NG before 0.16.0 Heap Buffer Overflow via Proxy ownKeys Enumeration",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-120438",
"datePublished": "2026-11-02T14:29:00.633Z",
"dateReserved": "2026-11-02T12:42:15.054Z",
"dateUpdated": "2026-11-02T14:29:00.633Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}