GHSA-wm7w-r6qf-3c9w: QuickJS-NG before 0.16.0 Memory Leak via Atomics.store

Published Nov 2, 2026

Updated

QuickJS-NG before 0.16.0 contains a memory leak vulnerability in jsatomicsstore() in quickjs.c that fails to free the converted value when returning a RangeError. Attackers running JavaScript can repeatedly call Atomics.store with a valueOf that detaches or shrinks the buffer to exhaust heap memory and cause denial of service.

Event History

Nov 2, 2026

CVE Published

via OSV·02:29 PM

Data Sourced

via OSV·02:29 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to denial of service?

Deployments that allow an attacker to run JavaScript in a QuickJS-NG version before 0.16.0 are exposed. The impact is heap-memory exhaustion and resulting denial of service.

What does an attacker need to do to trigger the issue?

The attacker needs the ability to execute JavaScript and repeatedly call Atomics.store. The supplied value must use valueOf to detach or shrink the buffer, causing Atomics.store to return a RangeError without freeing the converted value.

Which versions should be remediated?

QuickJS-NG versions before 0.16.0 are affected. Update to version 0.16.0 or later.

GHSA-wm7w-r6qf-3c9w: QuickJS-NG before 0.16.0 Memory Leak via Atomics.store

Event History

Frequently Asked Questions

Which deployments are exposed to denial of service?

What does an attacker need to do to trigger the issue?

Which versions should be remediated?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to denial of service?

What does an attacker need to do to trigger the issue?

Which versions should be remediated?