Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

11 records

Vendor: quickjs-ng Clear all filters
TI-2026-83832 CVE-2026-120440 · GHSA-48fx-7fjq-qgg4

Memory leak in QuickJS-NG Atomics.store exhausts heap memory

Priority LOW 37

QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the converted value when returning a RangeError.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00469 Published 2026-11-02 Fixed in 0.16.0 CWE-401
TI-2026-83831 CVE-2026-120439 · GHSA-xffc-9827-rpvc

Heap buffer overflow in QuickJS-NG TypedArray sort on 32-bit hosts

Priority HIGH 69

QuickJS-NG before 0.16.0 contains an integer overflow in js_typed_array_sort() in quickjs.c that allows attackers to cause a heap buffer overflow on 32-bit hosts.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00343 Published 2026-11-02 Fixed in 0.16.0 CWE-190
TI-2026-83830 CVE-2026-120438 · GHSA-m9xj-cppc-fm6c

Heap buffer overflow in QuickJS-NG via Proxy ownKeys enumeration

Priority LOW 38

QuickJS-NG before 0.16.0 contains an integer overflow in js_proxy_get_own_property_names() in quickjs.c that causes a heap buffer overflow on 32-bit hosts.

CVSS 4.0HIGH 8.5 Local Low privileges No interaction EPSS 0.0014 Published 2026-11-02 Fixed in 0.16.0 CWE-190
TI-2025-29365 CVE-2025-46687 · GHSA-hrc5-3jpv-g9x2

Resource allocation without limits in QuickJS

Priority HIGH 67

quickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a heap-based buffer overflow.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00304 Published 2025-04-27 Fixed in 2025-04-26 CWE-770