CVE-2026-120440

Name of the Vulnerable Software and Affected Versions QuickJS-NG versions prior to 0.16.0

Description A memory leak exists in the js atomics store() function within quickjs.c that occurs when a RangeError is returned because the converted value is not freed. An attacker executing JavaScript can trigger this by repeatedly calling Atomics.store using a valueOf that detaches or shrinks the buffer, leading to heap memory exhaustion and a denial of service.

Recommendations Update to version 0.16.0 or later. As a temporary mitigation, restrict the use of the js atomics store() function.