quickjs-ng quickjs quickjs.c js_typed_array_sort heap-based overflow
Priority MEDIUM 57CWE-119Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
A vulnerability was identified in quickjs-ng quickjs up to 0.11.0. This issue affects the function js_typed_array_sort of the file quickjs.c. The manipulation leads to heap-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is 53eefbcd695165a3bd8c584813b472cb4a69fbf5. To fix this issue, it is recommended to deploy a patch.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00461 40th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD and the CNA
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| quickjs-ng | quickjs | 0.1; 0.2; 0.3; 0.4; 0.5; 0.6; 0.7; 0.8; 0.9; 0.10; 0.11.0 | — | No fix listed | CNA |
- quickjs Vendorquickjs-ng Affected 0.1; 0.2; 0.3; 0.4; 0.5; 0.6; 0.7; 0.8; 0.9; 0.10; 0.11.0 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:quickjs-ng:quickjs:*:*:*:*:*:*:*:* | up to 0.11.0 | Vulnerable | quickjs-ng |
- cpe:2.3:a:quickjs-ng:quickjs:*:*:*:*:*:*:*:* Versions up to 0.11.0 Vulnerable ·quickjs-ng
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2026-0822
- 2026-10-03 Alias added: GHSA-67vh-536w-6pc4
References
Exploit 2
More quickjs-ng Quickjs vulnerabilities
- TI-2026-00603 quickjs-ng quickjs quickjs.c js_typed_array_constructor heap-based overflow CVSS 4.0MEDIUM 6.9
- TI-2025-29366 quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt… CVSS 3.1HIGH 8.4
- TI-2025-29365 Resource allocation without limits in QuickJS CVSS 3.1HIGH 7.8
- TI-2026-00873 quickjs-ng quickjs quickjs.c js_typed_array_constructor_ta heap-based overflow CVSS 4.0MEDIUM 5.3
- TI-2026-00872 quickjs-ng quickjs Atomics Ops quickjs.c use after free CVSS 4.0MEDIUM 5.3
- TI-2024-12923 quickjs-ng QuickJS qjs quickjs.c JS_GetRuntime stack-based overflow CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-0822 · CVE Program
- CVE-2026-0822 · NVD
- FIRST EPSS
- GHSA-67vh-536w-6pc4 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-0822 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences