Vulnerability · Published Nov 2, 2026 · Assigned by VulnCheck

CVE-2026-120440QuickJS-NG before 0.16.0 Memory Leak via Atomics.store

Medium 5.3

In plain English

A medium-severity memory leak in QuickJS-NG from quickjs-ng. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.5%top 59.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the converted value when returning a RangeError. Attackers running JavaScript can repeatedly call Atomics.store with a valueOf that detaches or shrinks the buffer to exhaust heap memory and cause denial of service.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:14	quickjs-ng	0.16.2-1	DEBIAN-CVE-2026-120440
Ubuntu:26.10	quickjs-ng	no fix listed	UBUNTU-CVE-2026-120440

Affected products (as reported)

Vendor	Product	Versions
quickjs-ng	QuickJS-NG	0 – before 0.16.0

Weakness: CWE-401 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

GitHub Security Advisory (GHSA-wm7w-r6qf-3c9w) vendor-advisory
https://github.com/quickjs-ng/quickjs/commit/62951e1bc68711d37aad986ff84ef0fe17038a7e patch
QuickJS-NG v0.16.0 Release Notes release-notes
https://github.com/quickjs-ng/quickjs/blob/v0.15.1/quickjs.c#L61154 technical-description
VulnCheck Advisory: QuickJS-NG before 0.16.0 Memory Leak via Atomics.store third-party-advisory