CVE-2026-0821
📋 TL;DR
A heap-based buffer overflow vulnerability in quickjs-ng's js_typed_array_constructor function allows remote attackers to execute arbitrary code or cause denial of service. This affects all systems running quickjs-ng versions up to 0.11.0. The vulnerability is remotely exploitable and has publicly available exploit details.
💻 Affected Systems
- quickjs-ng
📦 What is this software?
Quickjs by Quickjs Ng
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Denial of service through application crashes or memory corruption, potentially leading to service disruption.
If Mitigated
Application crashes without code execution if exploit fails or memory protections are in place.
🎯 Exploit Status
Exploit details are publicly disclosed in GitHub issues and the patch commit shows the specific manipulation required. Remote exploitation is confirmed possible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after commit c5d80831e51e48a83eab16ea867be87f091783c5
Vendor Advisory: https://github.com/quickjs-ng/quickjs/commit/c5d80831e51e48a83eab16ea867be87f091783c5
Restart Required: Yes
Instructions:
1. Update quickjs-ng to version after commit c5d80831e51e48a83eab16ea867be87f091783c5. 2. Rebuild any applications using quickjs-ng. 3. Restart affected services.
🔧 Temporary Workarounds
Disable JavaScript execution
allIf quickjs-ng is used for non-essential JavaScript processing, disable JavaScript execution entirely.
Configure application to not process JavaScript with quickjs-ng
Network segmentation
linuxRestrict network access to services using quickjs-ng to trusted networks only.
iptables -A INPUT -p tcp --dport [PORT] -s [TRUSTED_NETWORK] -j ACCEPT
iptables -A INPUT -p tcp --dport [PORT] -j DROP
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all JavaScript input processed by quickjs-ng
- Deploy memory protection mechanisms like ASLR and DEP to reduce exploit success rate
🔍 How to Verify
Check if Vulnerable:
Check quickjs-ng version: if version ≤ 0.11.0, system is vulnerable. Also check if commit c5d80831e51e48a83eab16ea867be87f091783c5 is not applied.Check Version:
quickjs --version or check package manager (apt list quickjs-ng, yum list quickjs-ng)Verify Fix Applied:
Verify quickjs-ng version is > 0.11.0 or that commit c5d80831e51e48a83eab16ea867be87f091783c5 is present in the source code.📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory access violations
- Segmentation faults in quickjs-ng processes
- Unusual JavaScript execution patterns
Network Indicators:
- Unexpected network connections from quickjs-ng processes
- Exploit traffic patterns targeting JavaScript processing endpoints
SIEM Query:
source="application.log" AND ("segmentation fault" OR "memory violation" OR "quickjs")🔗 References
- https://github.com/quickjs-ng/quickjs/
- https://github.com/quickjs-ng/quickjs/commit/c5d80831e51e48a83eab16ea867be87f091783c5
- https://github.com/quickjs-ng/quickjs/issues/1296
- https://github.com/quickjs-ng/quickjs/issues/1296#issue-3780003395
- https://github.com/quickjs-ng/quickjs/pull/1299
- https://vuldb.com/?ctiid.340355
- https://vuldb.com/?id.340355
- https://vuldb.com/?submit.731780
