CVE-2026-120438: QuickJS-NG before 0.16.0 Heap Buffer Overflow via Proxy ownKeys Enumeration

Published Nov 2, 2026

Updated

QuickJS-NG before 0.16.0 contains an integer overflow in jsproxygetownpropertynames() in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the allocation size, causing crashes or potential code execution.

Affected Software

1 affected component

ubuntu/quickjs-ng*

Event History

Nov 2, 2026

CVE Published

via OSV·02:29 PM

Data Sourced

via OSV·02:29 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Nov 3, 2026

Data Sourced

via OSV·12:00 AM

Affected Software

Frequently Asked Questions

Which deployments are exposed?

The issue affects QuickJS-NG versions before 0.16.0 when running on 32-bit hosts. Exposure requires an attacker to be able to run JavaScript in the affected runtime.

What does an attacker need to trigger the flaw?

The attacker needs to execute JavaScript that returns a large array-like object from a Proxy ownKeys trap. This can wrap the allocation size in the affected property-name enumeration code.

How can I determine whether an environment is affected?

Check whether the deployed QuickJS-NG version is earlier than 0.16.0 and whether it runs on a 32-bit host. Also determine whether untrusted or attacker-controlled JavaScript can execute in that runtime.

CVE-2026-120438: QuickJS-NG before 0.16.0 Heap Buffer Overflow via Proxy ownKeys Enumeration

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to trigger the flaw?

How can I determine whether an environment is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to trigger the flaw?

How can I determine whether an environment is affected?