TI-2026-00603 CVE-2026-0821 · GHSA-rcpp-qhfh-r47v
quickjs-ng quickjs quickjs.c js_typed_array_constructor heap-based overflow
Priority HIGH 70
A vulnerability was determined in quickjs-ng quickjs up to 0.11.0.
quickjs-ng
Records11All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
quickjs-ng records in CISA KEVNo quickjs-ng vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
11 records
TI-2025-29366 CVE-2025-46688 · GHSA-2qc3-w5w6-7r8m
quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt…
Priority HIGH 70
quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-based buffer overflow.
TI-2026-83831 CVE-2026-120439 · GHSA-xffc-9827-rpvc
Heap buffer overflow in QuickJS-NG TypedArray sort on 32-bit hosts
Priority HIGH 69
QuickJS-NG before 0.16.0 contains an integer overflow in js_typed_array_sort() in quickjs.c that allows attackers to cause a heap buffer overflow on 32-bit hosts.
TI-2025-29365 CVE-2025-46687 · GHSA-hrc5-3jpv-g9x2
Resource allocation without limits in QuickJS
Priority HIGH 67
quickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a heap-based buffer overflow.
TI-2026-00873 CVE-2026-1145 · GHSA-jqv9-g2ph-pfw9
quickjs-ng quickjs quickjs.c js_typed_array_constructor_ta heap-based overflow
Priority MEDIUM 57
A flaw has been found in quickjs-ng quickjs up to 0.11.0.
TI-2026-00872 CVE-2026-1144 · GHSA-2gmr-vqp5-r9qg
quickjs-ng quickjs Atomics Ops quickjs.c use after free
Priority MEDIUM 57
A vulnerability was detected in quickjs-ng quickjs up to 0.11.0.
TI-2026-00604 CVE-2026-0822 · GHSA-67vh-536w-6pc4
quickjs-ng quickjs quickjs.c js_typed_array_sort heap-based overflow
Priority MEDIUM 57
A vulnerability was identified in quickjs-ng quickjs up to 0.11.0.
TI-2026-03443 CVE-2026-3979 · GHSA-gr63-2w3v-w2gp
quickjs-ng quickjs quickjs.c js_iterator_concat_return use after free
Priority MEDIUM 55
A flaw has been found in quickjs-ng quickjs up to 0.12.1.
TI-2026-83830 CVE-2026-120438 · GHSA-m9xj-cppc-fm6c
Heap buffer overflow in QuickJS-NG via Proxy ownKeys enumeration
Priority LOW 38
QuickJS-NG before 0.16.0 contains an integer overflow in js_proxy_get_own_property_names() in quickjs.c that causes a heap buffer overflow on 32-bit hosts.
TI-2026-83832 CVE-2026-120440 · GHSA-48fx-7fjq-qgg4
Memory leak in QuickJS-NG Atomics.store exhausts heap memory
Priority LOW 37
QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the converted value when returning a RangeError.
TI-2024-12923 CVE-2024-13903 · GHSA-phgv-62jq-9jj7
quickjs-ng QuickJS qjs quickjs.c JS_GetRuntime stack-based overflow
Priority LOW 25
A vulnerability was found in quickjs-ng QuickJS up to 0.8.0.