quickjs-ng has 3 CVEs on record. 3 were published in the last 90 days. The busiest recent month was November 2026 with 3. The median CVSS is 7.0 (high).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.0
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
quickjs-ng vulnerabilities
CVEs affecting quickjs-ng, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-120440Medium· 5.3QuickJS-NG before 0.16.0 Memory Leak via Atomics.store
QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the converted value when returning a RangeError. Attackers running JavaScript can repeatedly call Atomics.store with a va…
CVE-2026-120438High· 7.8QuickJS-NG before 0.16.0 Heap Buffer Overflow via Proxy ownKeys Enumeration
QuickJS-NG before 0.16.0 contains an integer overflow in js_proxy_get_own_property_names() in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ow…
CVE-2026-120439High· 7.0PoCQuickJS-NG before 0.16.0 Heap Buffer Overflow via TypedArray.prototype.sort
QuickJS-NG before 0.16.0 contains an integer overflow in js_typed_array_sort() in quickjs.c that allows attackers to cause a heap buffer overflow on 32-bit hosts. Attackers who can run JavaScript can call TypedArray.prototype.sort with a…