Live › vulnerability › CVE-2026-120440
QuickJS-NG before 0.16.0 leaks the converted value in js_atomics_store() when it returns a RangeError. A script that repeatedly calls Atomics.store with a crafted valueOf can exhaust heap memory and cause a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Teams that embed QuickJS-NG before 0.16.0 and run JavaScript they do not fully trust are exposed, since the leak is triggered from script code. Applications that only run their own trusted scripts, or that do not use QuickJS-NG, can skip it.
No product ranges from the sources yet.
unknown if the sources do not give the command.0.16.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the converted value when returning a RangeError. Attackers running JavaScript can repeatedly call Atomics.store with a valueOf that detaches or shrinks the buffer to exhaust heap memory and cause denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-120440")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.