CVE-2026-0821: Quickjs-NG Quickjs

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

A vulnerability was determined in quickjs-ng quickjs up to 0.11.0. This vulnerability affects the function js_typed_array_constructor of the file quickjs.c. Executing a manipulation can lead to heap-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called c5d80831e51e48a83eab16ea867be87f091783c5. A patch should be applied to remediate this issue.

Affected products

• Quickjs-NG Quickjs: up to and including 0.11.0

Published 2026-01-10. Last modified 2026-06-17.