CVE-2026-120440 in QuickJS-NG
Summary
by MITRE • 11/02/2026
QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the converted value when returning a RangeError. Attackers running JavaScript can repeatedly call Atomics.store with a valueOf that detaches or shrinks the buffer to exhaust heap memory and cause denial of service.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in QuickJS-NG prior to version 0.16.0 represents a critical resource management flaw within its Just-In-Time (JIT) execution engine, specifically located in the js_atomics_store function found in quickjs.c. This component is responsible for handling atomic operations on shared memory buffers, which are essential for multi-threaded JavaScript applications utilizing Web Workers or similar concurrency models. The core technical deficiency lies in the error handling path of this function when it encounters a RangeError condition. Under normal operation, the engine converts input values to appropriate types before performing storage; however, during exception handling sequences triggered by invalid buffer states, the implementation fails to properly release memory allocated for these converted temporary objects. This oversight results in a classic memory leak where heap-allocated resources are retained indefinitely rather than being returned to the system pool upon function exit.
From an operational perspective, this flaw allows remote attackers who can execute arbitrary JavaScript code within the QuickJS environment to systematically exhaust available heap memory. By repeatedly invoking Atomics.store with values that possess custom valueOf methods designed to detach or shrink the underlying SharedArrayBuffer, an attacker can trigger the specific error path in js_atomics_store multiple times per iteration. Each invocation allocates new internal structures for type conversion but fails to free them due to the missing cleanup logic during exception propagation. Over time, this cumulative allocation leads to a severe depletion of system memory resources. The resulting state effectively renders the application unresponsive or causes it to crash entirely, constituting a Denial of Service condition that impacts availability and stability without requiring any form of authentication or privilege escalation beyond code execution capabilities.
This vulnerability aligns with CWE-401, which describes missing release of memory after effective usage, as well as CWE-789, concerning the improper control of resource allocation through uncontrolled memory consumption. In terms of offensive security frameworks, this exploit scenario maps to MITRE ATT&CK technique T1496, Resource Hijacking, specifically under sub-techniques involving denial of service via resource exhaustion. The attack vector relies on the interaction between JavaScript's dynamic typing system and C-level memory management boundaries, highlighting a common class of defects in embedded interpreters where exception handling paths are not rigorously audited for side effects like memory retention.
Mitigation strategies primarily involve upgrading to QuickJS-NG version 0.16.0 or later, where the developers have addressed this specific leak by ensuring proper deallocation of converted values even when RangeError exceptions occur. For environments unable to immediately patch, defensive coding practices should be implemented within any JavaScript code running in this context to avoid triggering edge cases that lead to buffer detachment during atomic operations. Additionally, implementing strict memory limits and monitoring heap usage metrics can help detect anomalous allocation patterns indicative of such exploitation attempts before they result in total system failure. Security teams should also review other areas of the engine's exception handling logic for similar omissions to prevent analogous vulnerabilities from being exploited through different code paths.