CVE-2026-120438 in QuickJS-NG
Summary
by MITRE • 11/02/2026
QuickJS-NG before 0.16.0 contains an integer overflow in js_proxy_get_own_property_names() in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the allocation size, causing crashes or potential code execution.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified as an integer overflow within the QuickJS-NG JavaScript engine prior to version 0.16.0 represents a critical security flaw located in the js_proxy_get_own_property_names function found in quickjs.c. This specific component is responsible for retrieving the list of own property names from a Proxy object, which serves as a meta-programming feature allowing developers to intercept and customize fundamental operations on objects. The core technical issue arises when an attacker constructs a malicious JavaScript payload that utilizes a Proxy with a custom ownKeys trap. By returning a large array-like object from this trap, the attacker can manipulate the internal logic of QuickJS-NG such that it miscalculates the required memory allocation size for storing property names. On 32-bit hosts, where integer arithmetic is more susceptible to wrapping due to limited bit-width, this manipulation results in an integer overflow. The engine allocates a buffer significantly smaller than what is actually needed based on the true number of properties or their combined length.
This heap buffer overflow occurs because subsequent operations attempt to write data into the undersized allocated memory region without performing adequate bounds checking against the actual size of the property list. When the JavaScript execution proceeds, it writes beyond the boundaries of the allocated heap segment. This out-of-bounds write corrupts adjacent memory structures on the heap, which can lead to immediate application crashes due to segmentation faults or access violations in less severe cases. However, in a more dangerous scenario involving sophisticated exploitation techniques, an attacker can leverage this memory corruption to achieve arbitrary code execution. By carefully crafting the overflow payload and controlling the data written into the corrupted memory regions, it is possible to overwrite function pointers, virtual table entries, or other critical control flow structures within the JavaScript engine's runtime environment.
From a threat modeling perspective, this vulnerability aligns with CWE-190, which describes integer overflow or wraparound leading to security implications such as buffer overflows. The exploitation vector falls under ATT&CK technique T1203, specifically focusing on exploit code for client-side attacks, and potentially T1496 if the impact leads to resource hijacking through denial of service via crashes. Since QuickJS-NG is often embedded in various applications including web servers, IoT devices, and desktop software that execute untrusted JavaScript content, the operational impact extends beyond simple browser sandbox escapes. An attacker who can inject or influence JavaScript code within an application using this vulnerable version of QuickJS-NG gains a powerful foothold to compromise system integrity. The risk is particularly acute in environments where 32-bit architectures are still prevalent for legacy compatibility reasons, as these systems lack the inherent protections against integer overflows that some modern 64-bit implementations might offer through larger address spaces and different memory layout characteristics.
Mitigation strategies must prioritize immediate upgrading to QuickJS-NG version 0.16.0 or later, where this specific integer overflow in js_proxy_get_own_property_names has been addressed by the developers. For organizations unable to upgrade immediately due to dependency constraints, implementing strict input validation on any JavaScript code that interacts with Proxy objects is essential. This includes limiting the size of arrays returned from ownKeys traps and ensuring that memory allocation requests are validated against maximum allowable thresholds before execution. Additionally, enabling heap protection mechanisms such as Address Sanitizer during development and testing phases can help detect similar issues early in the software lifecycle. Deploying runtime application self-protection tools or sandboxing environments where JavaScript is executed can also reduce the blast radius of potential exploitation attempts by isolating the engine from critical system resources.