CVE-2026-0821: 
NixOS vulnerability analysis and mitigation

CVE-2026-0821 is a heap-based buffer overflow vulnerability in the js_typed_array_constructor function (quickjs.c) of quickjs-ng QuickJS, a community-maintained fork of the QuickJS JavaScript engine. It affects all versions up to and including 0.11.0. The vulnerability was reported on January 5, 2026, by researcher Vlad Ionut Seba (mcsky23), publicly disclosed via a GitHub issue on January 10, 2026, and patched on January 7, 2026 via commit c5d80831e51e48a83eab16ea867be87f091783c5. NVD assigned a CVSS v3.1 base score of 9.8 (Critical), while the CNA (VulDB) rates it 7.3 (High) (GitHub Issue, Red Hat Advisory).

The root cause is a time-of-check/time-of-use (TOCTOU) race condition in js_typed_array_constructor (CWE-122: Heap-based Buffer Overflow; CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer). During typed array construction, the function calls js_create_from_ctor(), which internally invokes JS_GetProperty() to retrieve new_target.prototype. An attacker can define a JavaScript getter on new_target.prototype that resizes or detaches the backing ArrayBuffer mid-execution. When typed_array_init is subsequently called, it operates with stale buffer length/offset values, resulting in out-of-bounds memory access on the now-smaller heap buffer. A public PoC using Reflect.construct, ArrayBuffer.resize(), and a malicious getter was disclosed in the GitHub issue (GitHub Issue, GitHub Commit).

Successful exploitation can lead to heap memory corruption, potentially enabling remote code execution without authentication or user interaction. The vulnerability carries high confidentiality, integrity, and availability impacts — an attacker could read sensitive heap data, corrupt memory to alter program behavior, or crash the QuickJS process. Any application or service embedding quickjs-ng as a JavaScript runtime and accepting untrusted script input is at risk, including server-side runtimes, embedded scripting environments, and sandboxed execution contexts (Red Hat Advisory, GitHub Issue).

A proof-of-concept exploit was publicly disclosed in the GitHub issue tracker at the time of reporting, making exploitation accessible to a broad range of threat actors (GitHub Issue). The EPSS score is approximately 0.058%, indicating a currently low probability of widespread exploitation. No in-the-wild exploitation has been confirmed, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported. The CVSS v4.0 exploit maturity is rated "Proof of Concept" (Feedly).

1. Identify target: Locate an application or service embedding quickjs-ng QuickJS version ≤ 0.11.0 that accepts and executes untrusted JavaScript input (e.g., a server-side scripting engine or REPL).
2. Craft malicious JavaScript: Prepare a script that creates a resizable ArrayBuffer and defines a getter on a bound function's prototype property that calls ab.resize() to shrink the buffer mid-construction:

const ab = new ArrayBuffer(10, { maxByteLength: 10 });
function f() { return 1337; }
const evil = f.bind();
Object.defineProperty(evil, "prototype", { get: () => {
    return ab.resize(0); // shrink buffer to 0 bytes
}});
let u8 = Reflect.construct(Uint8Array, [ab], evil);
console.log(u8);

3. Trigger the vulnerability: Submit the crafted script to the target QuickJS runtime. When js_typed_array_constructor calls js_create_from_ctor(), the getter fires, resizing the ArrayBuffer before typed_array_init is called.
4. Achieve OOB access: The typed_array_init function is called with stale offset/length values referencing the now-smaller (or detached) buffer, causing a heap-buffer-overflow read/write.
5. Leverage for code execution: Depending on heap layout and platform mitigations, the OOB access can be developed into a more powerful primitive for arbitrary code execution within the process context (GitHub Issue, GitHub Commit).

• Process: Unexpected crashes or SIGABRT signals from processes embedding QuickJS (e.g., AddressSanitizer output referencing js_typed_array_constructor or js_get_fast_array_element).
• Logs: Application logs showing JavaScript exceptions related to RangeError: invalid offset or TypeError: detached ArrayBuffer in typed array construction paths (post-patch behavior; pre-patch these would be silent OOB accesses).
• File System: Core dump files generated by QuickJS-embedding processes, potentially containing heap artifacts from exploitation attempts.
• Network: Unusual or repeated submission of JavaScript payloads containing patterns such as Reflect.construct, ArrayBuffer with maxByteLength, and Object.defineProperty with getter functions targeting prototype to network-accessible QuickJS endpoints.

The fix is available as commit c5d80831e51e48a83eab16ea867be87f091783c5, merged into the master branch on January 7, 2026 via pull request #1299. Organizations should upgrade to any quickjs-ng release that includes this commit (i.e., any version after 0.11.0). As an interim workaround, restrict network access to services running vulnerable QuickJS versions and avoid executing untrusted JavaScript input until patched. Monitoring for suspicious typed array construction patterns in JavaScript inputs is also recommended (GitHub PR, GitHub Commit).

The vulnerability was noted by automated security feeds and aggregators including Red Packet Security and CVE tracking services shortly after disclosure. The fix was promptly merged by quickjs-ng maintainer saghul within two days of the report, with reviewer bnoordhuis approving the patch, reflecting a responsive open-source security process (GitHub PR). Red Hat tracked the issue via Bugzilla (bug #2428462) and published a security advisory (Red Hat Advisory). No significant broader media coverage or notable researcher commentary beyond the GitHub issue thread has been identified.