CVE-2026-86716: Cesanta mJS mjs_tok.c skip_spaces_and_comments heap-based overflow
A vulnerability was determined in Cesanta mJS up to 1.26. Affected is the function skipspacesandcomments of the file src/mjstok.c. Executing a manipulation can lead to heap-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
Prioritize any deployment using Cesanta mJS version 1.26 or earlier. The affected code is in src/mjs_tok.c, specifically the skip_spaces_and_comments function.
Does exploitation require authentication or user interaction?
No. The supplied vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
How immediate is the exploitation risk?
A public exploit disclosure exists and may be used. The project was reportedly notified through an issue report but has not responded, so no vendor response or remediation is identified in the provided data.