CVE Intelligence
Analysis AI-assisted

CVE-2026-0821: quickjs-ng QuickJS heap-based buffer overflow in js_typed_array_constructor

CVE-2026-0821 is a heap-based buffer overflow (CWE-119) in the js_typed_array_constructor function of quickjs.c in quickjs-ng QuickJS up to and including 0.11.0. NVD assigns a critical CVSS base score of 9.8 with network attack vector, and the record references a patch commit. No fixed release version is stated, and no confirmed active exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-0821 is a heap-based buffer overflow (CWE-119) in the js_typed_array_constructor function of quickjs.c in quickjs-ng QuickJS. The record places it in versions up to and including 0.11.0 and references a patch commit in the upstream repository.

Impact

  • NVD assigns a CVSS base score of 9.8 (critical) with network attack vector, low complexity, no privileges required and no user interaction, and high impact on confidentiality, integrity and availability.
  • Other scorers in the record (VulDB and cna@vuldb.com) provide lower scores, between 5.5 and 7.5 depending on the metric version.
  • The description states that the attack may be launched remotely.

Affected products and versions

  • Product: quickjs-ng QuickJS.
  • Affected range: up to and including 0.11.0. The record lists versions from 0.1 through 0.11.0.
  • The record does not state a fixed version.

Exploitation status

  • This CVE is not listed in the CISA KEV data in the record, so active exploitation in the wild is not confirmed by that source.
  • No confirmed active exploitation appears in the sources consulted.
  • The description states that the exploit has been publicly disclosed and may be used. The SSVC data rates exploitation as proof-of-concept level.
  • The EPSS probability is 0.0052 (about 0.52%) with a percentile of 0.43352.

Remediation and mitigation

  • Identify systems that embed or use quickjs-ng QuickJS at version 0.11.0 or earlier.
  • Review the referenced upstream commit and apply it, or move to a release that the maintainers confirm includes the fix.
  • Where patching is delayed, limit exposure of components that process untrusted JavaScript input, in line with your internal policy.

Detection guidance

  • Inventory the QuickJS versions in use across applications, services and embedded runtimes.
  • Monitor for crashes or abnormal terminations in processes running QuickJS when they handle untrusted input.
  • Follow the upstream issue and VulDB entries for status changes.

Limitations of the available information

  • The record names a patch commit but no fixed release version.
  • Scores differ across providers and metric versions.
  • Technical details of the trigger are intentionally omitted from this analysis.

Frequently asked questions

Which QuickJS versions are affected by CVE-2026-0821?

The record places the issue in quickjs-ng QuickJS up to and including 0.11.0, and lists versions from 0.1 through 0.11.0.

Is there a fixed version?

The record does not state a fixed release version. It references a patch commit in the upstream repository, so check the maintainers for a release that includes it.

Is this vulnerability being actively exploited?

This CVE is not listed in the CISA KEV data in the record, and no confirmed active exploitation appears in the sources consulted. The description says a public exploit exists.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.