Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-0821: quickjs-ng allows remote code execution via memory overflow

CVE-2026-0821 · published 9 months ago

Summary

The QuickJS JavaScript engine used in quickjs-ng, Alpine Linux's quickjs-ng package, and Debian's quickjs package can be tricked into writing past the end of its memory area. An attacker on the network could cause the program to crash or run code of their choice. Update the packages to the latest version that includes the new patch or install the provided fix.

What to do

Update alpine quickjs-ng to version 0.11.0-r2.
Update alpine quickjs-ng to version 0.11.0-r1.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	quickjs-ng	quickjs	<= 0.11.0 `cpe:2.3:a:quickjs-ng:quickjs::::::::`
Alpine:v3.24	alpine	quickjs-ng	< 0.11.0-r2 Fix: upgrade to 0.11.0-r2
Debian:13	debian	quickjs	All versions
Debian:14	debian	quickjs	All versions
Alpine:v3.23	alpine	quickjs-ng	< 0.11.0-r1 Fix: upgrade to 0.11.0-r1

Original advisory text

quickjs-ng quickjs quickjs.c js_typed_array_constructor heap-based overflow

A vulnerability was determined in quickjs-ng quickjs up to 0.11.0. This vulnerability affects the function js_typed_array_constructor of the file quickjs.c. Executing a manipulation can lead to heap-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called c5d80831e51e48a83eab16ea867be87f091783c5. A patch should be applied to remediate this issue.

References

https://github.com/quickjs-ng/quickjs/ URL
https://github.com/quickjs-ng/quickjs/pull/1299 Third Party Advisory
https://security.alpinelinux.org/vuln/CVE-2026-0821 Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2026-0821 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/0xxx/CVE-2026-0821.j... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-0821 Vendor Advisory
https://vuldb.com/?id.340355 Vendor Advisory
https://vuldb.com/?submit.731780 Vendor Advisory
https://github.com/quickjs-ng/quickjs/issues/1296 Third Party Advisory
https://github.com/quickjs-ng/quickjs/issues/1296#issue-3780003395 Third Party Advisory
https://vuldb.com/?ctiid.340355 Third Party Advisory
https://github.com/quickjs-ng/quickjs/commit/c5d80831e51e48a83eab16ea867be87f091... Patch

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

8.4 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-119Buffer Overflow

CWE-122Heap-based Buffer Overflow

Timeline

Published10 Jan 2026

Updated4 Nov 2026

First seen6 Mar 2026

Sources

CVE-2026-0821 · NVD

ALPINE-CVE-2026-0821 · OSV

DEBIAN-CVE-2026-0821 · OSV

CVE-2026-0821 · OSV

Track software like this

Free during beta