CVE-2026-0822: 
NixOS vulnerability analysis and mitigation

CVE-2026-0822 is a heap-based buffer overflow vulnerability in the js_typed_array_sort function of quickjs-ng/quickjs, affecting all versions up to and including 0.11.0. The flaw was reported on January 5, 2026, by researcher Mcsky23 (Vlad Ionut Seba), with the CVE published on January 10, 2026, and patched on January 6, 2026 via commit 53eefbcd695165a3bd8c584813b472cb4a69fbf5 (GitHub Issue, GitHub Commit). NVD assigns a CVSS v3.1 base score of 8.8 (High), while the CNA (VulDB) rates it 6.3 (Medium) (Red Hat Advisory).

The root cause is an out-of-bounds write (CWE-787) and heap-based buffer overflow (CWE-122) in quickjs.c within the js_typed_array_sort function. After rqsort is called, the function uses an index array (array_idx) to reconstruct the sorted typed array; the expression j = array_idx[i] can produce an index exceeding the current buffer size if a user-supplied comparator callback resizes the underlying ArrayBuffer mid-sort. This bypasses the OOB check in js_TA_cmp_generic because large indices are already placed in valid positions before the resize occurs, allowing subsequent heap reads/writes beyond the allocated region (GitHub Issue). The attack requires user interaction (execution of attacker-controlled JavaScript) and no privileges, making it exploitable remotely in contexts where untrusted JS is evaluated (Red Hat Advisory).

Successful exploitation can result in heap memory disclosure (confidentiality impact), memory corruption and data modification (integrity impact), and application crash or denial of service (availability impact). In environments where quickjs-ng is used as an embedded scripting engine — such as server-side runtimes, IoT firmware, or sandboxed execution environments — exploitation could allow an attacker to read sensitive heap contents or potentially achieve code execution, depending on heap layout and mitigations in place (GitHub Issue, Red Hat Advisory).

A public proof-of-concept exploit was included in the original bug report filed on January 5, 2026, demonstrating the heap buffer overflow via ASAN output (GitHub Issue). The EPSS score is approximately 0.049%, indicating low current probability of widespread exploitation. There is no evidence of in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat Advisory).

1. Identify target: Locate an application or service that embeds quickjs-ng version 0.11.0 or earlier and evaluates user-supplied or attacker-influenced JavaScript code.
2. Craft malicious JavaScript: Prepare a script that creates a resizable ArrayBuffer and a Uint8Array view, then calls .sort() with a custom comparator function.
3. Trigger sort with resize: Inside the comparator callback, count invocations and at a specific iteration (e.g., the 1734th call, determined empirically), invoke ab.resize(newSz) to shrink the buffer while rqsort has already placed large indices (e.g., index 255) at the front of array_idx.
4. Bypass OOB check: Because the large index was moved to a valid position before the resize, the bounds check in js_TA_cmp_generic is not triggered, and js_typed_array_sort proceeds to use the stale index.
5. Achieve OOB read/write: The line ((uint8_t *)array_ptr)[i] = ((uint8_t *)array_tmp)[j] reads from heap memory 245+ bytes beyond the now-shrunken 10-byte buffer, causing a heap buffer overflow detectable via ASAN or exploitable for memory disclosure/corruption (GitHub Issue).

• Process: Unexpected crash or abort of a process embedding quickjs-ng, particularly with ASAN output referencing js_typed_array_sort in quickjs.c.
• Logs: Application logs showing unhandled exceptions or aborts originating from the QuickJS engine during typed array sort operations; crash dumps referencing js_typed_array_sort or js_call_c_function.
• File System: Core dump files generated by the quickjs-ng process, potentially containing heap memory contents from the time of the overflow.
• Network: Unusual or repeated submission of JavaScript payloads containing ArrayBuffer, Uint8Array, and .sort() with resize logic to services that evaluate JS via quickjs-ng (GitHub Issue).

Apply the fix introduced in commit 53eefbcd695165a3bd8c584813b472cb4a69fbf5, merged into the master branch on January 6, 2026 via pull request #1298. The fix adds bounds checks (if (j < len)) before each typed array element copy in js_typed_array_sort for all element sizes (1, 2, 4, and 8 bytes), preventing out-of-bounds access when array_idx[i] exceeds the current buffer length (GitHub Commit, GitHub PR). Organizations should update to any quickjs-ng release built after January 6, 2026. As a temporary workaround where patching is not immediately possible, restrict or sandbox execution of untrusted JavaScript input processed by the affected engine.

Red Hat tracked the vulnerability via Bugzilla (bug #2428463) and published a security advisory page, indicating awareness among enterprise Linux distributors (Red Hat Advisory). Tenable added detection via Nessus plugin 282568, and the vulnerability was indexed by INCIBE-CERT and multiple threat intelligence aggregators shortly after disclosure. No significant public researcher commentary or social media debate beyond routine CVE tracking has been observed.