Live › vulnerability › CVE-2026-120438
QuickJS-NG versions before 0.16.0 have an integer overflow in js_proxy_get_own_property_names() that causes a heap buffer overflow on 32-bit hosts. An attacker who can run JavaScript can crash the process or possibly execute code by returning a large array-like object from a Proxy ownKeys trap.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Applications that embed QuickJS-NG and run JavaScript, especially on 32-bit hosts, are exposed. Exposure is greatest where untrusted scripts can create Proxy objects. Teams using QuickJS-NG only with trusted code on 64-bit hosts are less exposed, but should still upgrade.
No product ranges from the sources yet.
0.16.0 is in the affected range.0.16.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
QuickJS-NG before 0.16.0 contains an integer overflow in js_proxy_get_own_property_names() in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the allocation size, causing crashes or potential code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-120438")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.