CVE-2026-1144: 
NixOS vulnerability analysis and mitigation

CVE-2026-1144 is a heap use-after-free (UAF) vulnerability in the Atomics Ops Handler of quickjs-ng QuickJS, a next-generation fork of the QuickJS JavaScript engine. It affects all versions up to and including 0.11.0, with the flaw residing in quickjs.c. The vulnerability was reported by researcher Mcsky23 (Vlad Ionut Seba) on January 5, 2026, and publicly disclosed on January 19, 2026. NVD assigns a CVSS v3.1 base score of 8.8 (High), while the CNA (VulDB) rates it 6.3 (Medium) (Red Hat CVE, GitHub Issue #1301).

The root cause is a use-after-free condition (CWE-416) in the js_atomics_store and js_atomics_op functions within quickjs.c. Both functions call js_atomics_get_ptr to cache a raw pointer into a resizable ArrayBuffer's heap memory. When a subsequent type-conversion call (JS_ToIntegerFree in js_atomics_store, or JS_ToUint32 in js_atomics_op) is made to coerce a user-supplied value, a JavaScript object's valueOf() method can be invoked as a side effect. If that valueOf() triggers ArrayBuffer.resize(0), the underlying buffer is reallocated or freed, invalidating the cached pointer. The stale pointer is then used in the atomic operation (e.g., atomic_store), resulting in a heap-use-after-free write. The bug affects Atomics.store, Atomics.add, Atomics.sub, Atomics.and, Atomics.or, Atomics.xor, Atomics.exchange, and Atomics.compareExchange (GitHub Issue #1301, GitHub Issue #1302, Fix Commit).

Successful exploitation can lead to memory corruption, potentially enabling arbitrary code execution in the context of the process running the vulnerable QuickJS engine. The vulnerability carries high confidentiality, integrity, and availability impact per NVD's CVSS v3.1 assessment. Applications embedding quickjs-ng as a scripting engine — such as server-side runtimes, IoT firmware, or sandboxed environments — are at risk of complete compromise if an attacker can supply malicious JavaScript. At minimum, the UAF write can cause a crash (denial of service) (Red Hat CVE, Feedly).

Public proof-of-concept (PoC) exploit code was published in GitHub issues #1301 and #1302 by the reporter on January 5, 2026, prior to the CVE's public disclosure. The PoC demonstrates the UAF using a crafted ArrayBuffer with a resizable backing store and a malicious valueOf() method. Exploitation requires user interaction (i.e., the target must evaluate attacker-controlled JavaScript), and no authentication is required. There is no confirmed evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.038% (GitHub Issue #1301, GitHub Issue #1302, Feedly).

1. Craft malicious JavaScript: Create a script that allocates a resizable ArrayBuffer and a typed array view over it, then defines an object with a valueOf() method that calls rab.resize(0) to shrink the buffer to zero bytes.
2. Trigger the Atomics operation: Pass the malicious object as the value argument to an Atomics function such as Atomics.store(i32, 0, evil) or Atomics.add(i32, 0, evil), where evil is the object with the malicious valueOf().
3. Induce the UAF: When QuickJS internally calls JS_ToIntegerFree (or JS_ToUint32) to coerce the value, the valueOf() method fires, triggering js_array_buffer_resize which frees and reallocates the underlying buffer memory, invalidating the previously cached pointer.
4. Achieve memory corruption: QuickJS proceeds to use the now-stale pointer in the atomic write operation (e.g., atomic_store), writing to freed heap memory — resulting in a heap-use-after-free that can crash the process or, with heap grooming, enable arbitrary code execution.

PoC (from public disclosure):

const rab = new ArrayBuffer(1024, { maxByteLength: 1024 * 1024 });
const i32 = new Int32Array(rab);
const evil = {
  valueOf: () => {
    rab.resize(0);
    return 123;
  }
};
Atomics.store(i32, 0, evil);

(GitHub Issue #1301, GitHub Issue #1302)

• Process Behavior: Unexpected crashes or aborts in processes embedding quickjs-ng, particularly with AddressSanitizer output referencing js_atomics_store or js_atomics_op and heap-use-after-free errors.
• Logs: Application logs showing RangeError: out-of-bound access exceptions originating from Atomics operations on resizable ArrayBuffer objects (post-patch behavior); pre-patch, crashes or silent memory corruption may be logged instead.
• File System: Core dump files generated by the quickjs process following an unexpected abort (==ABORTING in ASAN output).
• JavaScript Artifacts: Presence of JavaScript files or inputs containing patterns such as ArrayBuffer with maxByteLength, rab.resize(0) inside a valueOf() method, combined with Atomics.store, Atomics.add, Atomics.sub, Atomics.and, Atomics.or, Atomics.xor, or Atomics.exchange calls. (GitHub Issue #1301, GitHub Issue #1302)

The fix is available as commit ea3e9d77454e8fc9cb3ef3c504e9c16af5a80141 merged into the master branch on January 6, 2026, via pull request #1303. The patch refactors js_atomics_get_ptr into js_atomics_get_buf, which defers pointer computation until after value coercion is complete, and adds bounds checks to detect if a valueOf() side effect has resized or detached the array buffer. Organizations should upgrade quickjs-ng to any version built from commits after ea3e9d7. As a workaround where upgrading is not immediately possible, disable or restrict use of Atomics operations and resizable ArrayBuffer features, and avoid evaluating untrusted JavaScript (Fix Commit, GitHub PR #1303, Red Hat CVE).

Red Hat tracked the vulnerability via Bugzilla (bug #2430785) and published a CVE advisory page. The fix was reviewed and approved by quickjs-ng contributor bnoordhuis, who also suggested submitting regression tests to the TC39 test262 suite so the fix would propagate to all JavaScript engines. The vulnerability received coverage from automated threat intelligence aggregators including Vulners, CIRCL, and radar.offseq.com shortly after disclosure (Red Hat CVE, GitHub PR #1303).