CVE-2026-1144
quickjs-ng quickjs Atomics Ops quickjs.c use after free
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was detected in quickjs-ng quickjs up to 0.11.0. Affected is an unknown function of the file quickjs.c of the component Atomics Ops Handler. The manipulation results in use after free. The attack can be executed remotely. The exploit is now public and may be used. The patch is identified as ea3e9d77454e8fc9cb3ef3c504e9c16af5a80141. Applying a patch is advised to resolve this issue.
| CWE | CWE-416 CWE-119 |
| Vendor | quickjs-ng |
| Product | quickjs |
| Published | Jan 19, 2026 |
| Last Updated | Feb 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for quickjs-ng quickjs
Be the first to know when new medium vulnerabilities affecting quickjs-ng quickjs are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
quickjs-ng / quickjs
0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 0.10 0.11.0
References
vuldb.com: https://vuldb.com/?id.341737 vuldb.com: https://vuldb.com/?ctiid.341737 vuldb.com: https://vuldb.com/?submit.735537 vuldb.com: https://vuldb.com/?submit.735538 github.com: https://github.com/quickjs-ng/quickjs/issues/1301 github.com: https://github.com/quickjs-ng/quickjs/pull/1303 github.com: https://github.com/quickjs-ng/quickjs/issues/1302 github.com: https://github.com/quickjs-ng/quickjs/commit/ea3e9d77454e8fc9cb3ef3c504e9c16af5a80141 github.com: https://github.com/quickjs-ng/quickjs/
Credits
🔍 mcsky23 (VulDB User)