quickjs-ng quickjs Atomics Ops quickjs.c use after free
Priority MEDIUM 57CWE-119Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
A vulnerability was detected in quickjs-ng quickjs up to 0.11.0. Affected is an unknown function of the file quickjs.c of the component Atomics Ops Handler. The manipulation results in use after free. The attack can be executed remotely. The exploit is now public and may be used. The patch is identified as ea3e9d77454e8fc9cb3ef3c504e9c16af5a80141. Applying a patch is advised to resolve this issue.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0042 36th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD and the CNA
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| quickjs-ng | quickjs | 0.1; 0.2; 0.3; 0.4; 0.5; 0.6; 0.7; 0.8; 0.9; 0.10; 0.11.0 | — | No fix listed | CNA |
- quickjs Vendorquickjs-ng Affected 0.1; 0.2; 0.3; 0.4; 0.5; 0.6; 0.7; 0.8; 0.9; 0.10; 0.11.0 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:quickjs-ng:quickjs:*:*:*:*:*:*:*:* | up to 0.11.0 | Vulnerable | quickjs-ng |
- cpe:2.3:a:quickjs-ng:quickjs:*:*:*:*:*:*:*:* Versions up to 0.11.0 Vulnerable ·quickjs-ng
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2026-1144
- 2026-10-03 Alias added: GHSA-2gmr-vqp5-r9qg
References
More quickjs-ng Quickjs vulnerabilities
- TI-2026-00603 quickjs-ng quickjs quickjs.c js_typed_array_constructor heap-based overflow CVSS 4.0MEDIUM 6.9
- TI-2025-29366 quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt… CVSS 3.1HIGH 8.4
- TI-2025-29365 Resource allocation without limits in QuickJS CVSS 3.1HIGH 7.8
- TI-2026-00873 quickjs-ng quickjs quickjs.c js_typed_array_constructor_ta heap-based overflow CVSS 4.0MEDIUM 5.3
- TI-2026-00604 quickjs-ng quickjs quickjs.c js_typed_array_sort heap-based overflow CVSS 4.0MEDIUM 5.3
- TI-2024-12923 quickjs-ng QuickJS qjs quickjs.c JS_GetRuntime stack-based overflow CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-1144 · CVE Program
- CVE-2026-1144 · NVD
- FIRST EPSS
- GHSA-2gmr-vqp5-r9qg · GitHub Advisory Database · CC BY 4.0
- CVE-2026-1144 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences