CVE-2026-1144
📋 TL;DR
This CVE describes a use-after-free vulnerability in quickjs-ng's Atomics Ops Handler component that can be exploited remotely. Attackers could potentially execute arbitrary code or cause denial of service by manipulating freed memory. Any system running vulnerable versions of quickjs-ng is affected.
💻 Affected Systems
- quickjs-ng
📦 What is this software?
Quickjs by Quickjs Ng
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or persistent backdoor installation.
Likely Case
Denial of service through application crashes or limited memory corruption leading to instability.
If Mitigated
Application crashes without privilege escalation if proper sandboxing and memory protections are in place.
🎯 Exploit Status
The exploit is public and may be used, but successful exploitation requires specific memory manipulation conditions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after commit ea3e9d77454e8fc9cb3ef3c504e9c16af5a80141
Vendor Advisory: https://github.com/quickjs-ng/quickjs/issues/1301
Restart Required: Yes
Instructions:
1. Update quickjs-ng to a version containing commit ea3e9d77454e8fc9cb3ef3c504e9c16af5a80141
2. Rebuild any applications using quickjs-ng
3. Restart affected services
🔧 Temporary Workarounds
Disable Atomics Operations
allDisable Atomics operations in quickjs-ng configuration if not required
Configure quickjs-ng with -DQUICKJS_DISABLE_ATOMICS=1 during build
Network Segmentation
allRestrict network access to services using quickjs-ng
Use firewall rules to limit access to necessary IPs only
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to limit exposure
- Deploy memory protection mechanisms like ASLR and DEP if available
🔍 How to Verify
Check if Vulnerable:
Check quickjs-ng version: if version ≤ 0.11.0, system is vulnerableCheck Version:
quickjs --version or check build configurationVerify Fix Applied:
Verify quickjs-ng includes commit ea3e9d77454e8fc9cb3ef3c504e9c16af5a80141📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory access violations
- Unexpected quickjs-ng process termination
Network Indicators:
- Unusual network traffic to services using quickjs-ng
- Suspicious payloads targeting Atomics operations
SIEM Query:
process_name:"quickjs" AND (event_type:"crash" OR memory_violation:"true")🔗 References
- https://github.com/quickjs-ng/quickjs/
- https://github.com/quickjs-ng/quickjs/commit/ea3e9d77454e8fc9cb3ef3c504e9c16af5a80141
- https://github.com/quickjs-ng/quickjs/issues/1301
- https://github.com/quickjs-ng/quickjs/issues/1302
- https://github.com/quickjs-ng/quickjs/pull/1303
- https://vuldb.com/?ctiid.341737
- https://vuldb.com/?id.341737
- https://vuldb.com/?submit.735537
- https://vuldb.com/?submit.735538
