CVE-2026-0821

High

Description

A vulnerability was determined in quickjs-ng quickjs up to 0.11.0. This vulnerability affects the function js_typed_array_constructor of the file quickjs.c. Executing a manipulation can lead to heap-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called c5d80831e51e48a83eab16ea867be87f091783c5. A patch should be applied to remediate this issue.

SeverityHigh

CVSS7.3

Exploit probability—

ProductQuickjs

PublishedJan 10, 2026

First seenJan 10, 2026

Weakness typeCWE-122CWE-122 CWE-119Memory buffer bounds error

How to fix

Patches

github.com/quickjs-ng/quickjs/commit/c5d80831e51e48a83eab16ea867be87f091783c5

Affected products

Product	Affected versions	Fixed in
quickjs-ng quickjs	v ≤ 0.11.0	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.