CVE-2026-0821 is a heap-based buffer overflow in quickjs-ng QuickJS, in the typed array constructor, affecting versions up to 0.11.0. NVD scores it 7.3, high severity. The fix is commit c5d8083, merged on 7 January 2026; confirm which release you need in the project notes.
What's affected
- Product: quickjs-ng QuickJS, the actively maintained fork of the QuickJS JavaScript engine. The record lists versions up to 0.11.0.
- Component: the function js_typed_array_constructor in quickjs.c.
- Fix: pull request 1299, "Fix heap buffer overflow via side-effects in js_typed_array_constructor", merged into master on 7 January 2026 as commit c5d80831e51e48a83eab16ea867be87f091783c5. It fixes issue 1296 and adds a regression test.
- Fixed release: the record does not name one. I did not confirm which tagged release first contains the commit, so check the project release notes, or build from a revision that includes it.
- Severity: CVSS 7.3, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. - Exploitation: the record says the exploit is public. It is not on the CISA KEV list.
How to check if you're exposed
QuickJS is usually embedded, not installed, so the question is where a copy lives in your products. Three places to look.
In a source tree you build from, test whether the fix commit is already part of your history:
git merge-base --is-ancestor c5d80831e51e48a83eab16ea867be87f091783c5 HEAD && echo "fix present" || echo "fix missing"
In a vendored copy without git history, search for the function and read the code that follows the call to the constructor helper:
grep -rn "js_typed_array_constructor" --include=quickjs.c .
The fix re-checks the array buffer after that helper runs. If your copy has no such re-validation, treat it as unpatched.
In shipped binaries and containers, use an SBOM. The free scan at gold.safeguard.sh/scan reads dependency manifests in your browser, and the Gold directory lists known issues by component. Native code that was copied into a repository will not show in a manifest, so also search your build files for the quickjs name.
What to do now
- List every product, plugin and tool that embeds quickjs-ng. Check build scripts, git submodules, vendored folders and container layers.
- Update to a quickjs-ng release that includes commit c5d8083. Confirm the first such release in the project release notes before you pin it.
- If you build from source, rebase on a revision that contains the fix, then run the test that was added with it.
- Until you have updated, do not run untrusted JavaScript in an affected engine. Where the engine only runs scripts you wrote, the exposure is much smaller.
- Rebuild and redeploy every artifact that bundles the engine, then record the new version in your inventory.
Why it matters
The weakness is CWE-122 (heap-based buffer overflow), a more specific child of CWE-119 (improper restriction of operations within the bounds of a memory buffer). The pull request title gives the cause: side effects. In the patch, the added comment explains that the code which creates the typed array from a constructor can run JavaScript, and that script may resize or detach the buffer the constructor is about to use. The fix re-checks the buffer after that step.
This is a common pattern in language runtimes. A native function reads a size, calls back into user script, and then keeps using the size it read before the call. If the script changed the buffer in between, the native code writes past the end. Fixes tend to be small, a few checks placed after the call, which is why the patch is short.
For users, the question is not whether you use QuickJS directly. It is whether anything you ship embeds it and runs input you do not control: a plugin system, an automation tool, a game scripting layer, an extension host. For those, the CVSS vector in the record rates all three impacts as low but needs no login and no user action, so exposure comes down to who can feed the engine a script.
Try it yourself
Embedded engines are easy to forget because they hide inside other products. This demo shows how a dependency inventory surfaces them so you can match them to advisories like this one.
Click through it at your own pace, or open it full screen.
Quick check
Which release of quickjs-ng contains the fix?
The CVE record does not say. The fix is commit c5d8083, merged on 7 January 2026. Check the project release notes for the first tag that includes it.
Do I need to worry if I only run my own scripts?
The exposure is much smaller, since the flaw needs a crafted script to reach it. Still update, because scripts and inputs change over time.
Sources
Last reviewed: 19 October 2026.
