{"id":"CVE-2026-120440","kind":"vulnerability","aliases":["CVE-2026-120440"],"related":[],"title":"QuickJS-NG: memory leak in Atomics.store lets scripts exhaust heap","description":"QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the converted value when returning a RangeError. Attackers running JavaScript can repeatedly call Atomics.store with a valueOf that detaches or shrinks the buffer to exhaust heap memory and cause denial of service.","summary":"QuickJS-NG before 0.16.0 leaks the converted value in js_atomics_store() when it returns a RangeError. A script that repeatedly calls Atomics.store with a crafted valueOf can exhaust heap memory and cause a denial of service.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded-js","javascript-engine","quickjs-ng","runtime"],"not_affected_if":["no-quickjs-ng","quickjs-ng-0.16.0-or-later","trusted-scripts-only"],"how_to_check":"- Check the installed QuickJS-NG version, for example by looking at the version in the build or package you ship: `unknown` if the sources do not give the command.\n- Look for any embedding that runs untrusted JavaScript through QuickJS-NG.","fix":"- QuickJS-NG: move to `0.16.0` or later.","status":"open","published_at":"2026-11-02T15:17:26+00:00","first_seen_at":"2026-11-02T15:24:02+00:00","triaged_at":"2026-11-02T15:26:12+00:00","updated_at":"2026-11-02T15:26:12+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-02T15:26:12Z","model":"claude-haiku-5-5","output":{"fix":"- QuickJS-NG: move to `0.16.0` or later.","reach":"unknown","title":"QuickJS-NG: memory leak in Atomics.store lets scripts exhaust heap","impact":"low","summary":"QuickJS-NG before 0.16.0 leaks the converted value in js_atomics_store() when it returns a RangeError. A script that repeatedly calls Atomics.store with a crafted valueOf can exhaust heap memory and cause a denial of service.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["quickjs-ng","javascript-engine","embedded-js"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"script exhausts heap memory, causing denial of service","analyst_note":"","how_to_check":"- Check the installed QuickJS-NG version, for example by looking at the version in the build or package you ship: `unknown` if the sources do not give the command.\n- Look for any embedding that runs untrusted JavaScript through QuickJS-NG.","plain_action":"","needs_analyst":false,"not_affected_if":["quickjs-ng-0.16.0-or-later","trusted-scripts-only","no-quickjs-ng"],"who_is_affected":"Teams that embed QuickJS-NG before 0.16.0 and run JavaScript they do not fully trust are exposed, since the leak is triggered from script code. Applications that only run their own trusted scripts, or that do not use QuickJS-NG, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000705,"input_tokens":4225,"output_tokens":565,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120440':14A,17A '-2026':13A,16A '0.16.0':32B,70C 'atom':39B,78C 'atomics.store':7A,51B,99C 'attack':93C 'buffer':108C 'call':50B,98C 'caus':61B,114C 'contain':71C 'convert':35B,87C 'craft':54B 'cve':12A,15A 'denial':63B,115C 'detach':104C 'embed':19B 'embedded-j':18B 'engin':23B 'exhaust':10A,57B,110C 'fail':83C 'free':85C 'heap':11A,58B,111C 'javascript':22B,95C 'javascript-engin':21B 'js':20B,38B,77C 'leak':5A,33B,74C 'let':8A 'memori':4A,59B,73C,112C 'ng':3A,26B,30B,68C 'quickj':2A,25B,29B,67C 'quickjs-ng':1A,24B,28B,66C 'quickjs.c':81C 'rangeerror':45B,92C 'repeat':49B,97C 'return':43B,90C 'run':94C 'runtim':27B 'script':9A,47B 'servic':65B,117C 'shrink':106C 'store':40B,79C 'valu':36B,88C 'valueof':55B,102C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Teams that embed QuickJS-NG before 0.16.0 and run JavaScript they do not fully trust are exposed, since the leak is triggered from script code. Applications that only run their own trusted scripts, or that do not use QuickJS-NG, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["embeddedjs","javascriptengine","medium","quickjsng","runtime"],"first_public_at":"2026-07-31T15:05:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120440","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120440","severity":null,"published_at":"2026-11-02T15:17:26+00:00","modified_at":"2026-11-02T15:17:26+00:00","first_seen_at":"2026-11-02T15:24:02+00:00","fetched_at":"2026-11-02T15:24:02+00:00","note":null}],"documents":[{"id":52468,"url":"https://github.com/quickjs-ng/quickjs/commit/62951e1bc68711d37aad986ff84ef0fe17038a7e","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":52461,"url":"https://github.com/quickjs-ng/quickjs/releases/tag/v0.16.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":52470,"url":"https://github.com/quickjs-ng/quickjs/security/advisories/GHSA-wm7w-r6qf-3c9w","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-31T15:05:41+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":52471,"url":"https://www.vulncheck.com/advisories/quickjs-ng-before-0.16.0-memory-leak-via-atomics-store","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}