CVE-2026-120440
Received Received - Intake

Memory Leak in QuickJS-NG JavaScript Engine

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: VulnCheck

Description
QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the converted value when returning a RangeError. Attackers running JavaScript can repeatedly call Atomics.store with a valueOf that detaches or shrinks the buffer to exhaust heap memory and cause denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-120440

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
quickjs-ng QuickJS-NG 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a memory leak in QuickJS-NG versions before 0.16.0. It occurs in the js_atomics_store() function when a RangeError is returned without freeing a converted value. Attackers can repeatedly call Atomics.store with a valueOf method that detaches or shrinks buffers, causing heap memory exhaustion and denial of service.

Detection Guidance

Monitor for unusual memory consumption in applications using QuickJS-NG versions before 0.16.0. Check for processes running QuickJS-NG and inspect memory usage patterns. Look for repeated calls to Atomics.store with valueOf methods that detach or shrink buffers.

Impact Analysis

This vulnerability can cause denial of service by exhausting system memory. Long-running applications like servers or IoT devices are particularly vulnerable. Attackers could repeatedly trigger the issue in a loop, leading to resource exhaustion and potential system crashes.

Compliance Impact

This vulnerability primarily causes memory exhaustion leading to denial of service, which may indirectly impact compliance by disrupting system availability. GDPR requires ensuring data processing integrity and availability, while HIPAA mandates safeguards against service disruptions. However, the CVE does not directly reference compliance standards or their specific impacts.

Mitigation Strategies

Upgrade QuickJS-NG to version 0.16.0 or later to address the memory leak. If upgrading is not immediately possible, restrict access to JavaScript execution environments where this vulnerability could be exploited.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120440. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...