A flaw has been found in quickjs-ng quickjs up to 0.11.0. Affected by this vulnerability is the function js_typed_array_constructor_ta of the file quickjs.c. This manipulation causes heap-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: 53aebe66170d545bb6265906fe4324e4477de8b4. It is suggested to install a patch to address this issue.
References
| Link | Resource |
|---|---|
| https://github.com/paralin/quickjs/commit/53aebe66170d545bb6265906fe4324e4477de8b4 | Patch |
| https://github.com/quickjs-ng/quickjs/issues/1305 | Exploit Issue Tracking |
| https://github.com/quickjs-ng/quickjs/issues/1305#issue-3785444372 | Issue Tracking Exploit |
| https://github.com/quickjs-ng/quickjs/pull/1306 | Patch Issue Tracking |
| https://vuldb.com/?ctiid.341738 | Permissions Required VDB Entry |
| https://vuldb.com/?id.341738 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.735539 | Third Party Advisory VDB Entry |
Configurations
History
30 Jan 2026, 14:59
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Quickjs-ng quickjs
Quickjs-ng |
|
| CPE | cpe:2.3:a:quickjs-ng:quickjs:*:*:*:*:*:*:*:* | |
| References | () https://github.com/paralin/quickjs/commit/53aebe66170d545bb6265906fe4324e4477de8b4 - Patch | |
| References | () https://github.com/quickjs-ng/quickjs/issues/1305 - Exploit, Issue Tracking | |
| References | () https://github.com/quickjs-ng/quickjs/issues/1305#issue-3785444372 - Issue Tracking, Exploit | |
| References | () https://github.com/quickjs-ng/quickjs/pull/1306 - Patch, Issue Tracking | |
| References | () https://vuldb.com/?ctiid.341738 - Permissions Required, VDB Entry | |
| References | () https://vuldb.com/?id.341738 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?submit.735539 - Third Party Advisory, VDB Entry |
19 Jan 2026, 09:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-19 09:16
Updated : 2026-01-30 14:59
NVD link : CVE-2026-1145
Mitre link : CVE-2026-1145
CVE.ORG link : CVE-2026-1145
JSON object : View
Products Affected
quickjs-ng
- quickjs