CVE-2026-1145: 
NixOS vulnerability analysis and mitigation

CVE-2026-1145 is a heap-based buffer overflow vulnerability in the js_typed_array_constructor_ta function of quickjs.c in quickjs-ng QuickJS up to version 0.11.0. It was reported on January 6, 2026 by researcher Mcsky23 (Vlad Ionut Seba) and published to NVD on January 19, 2026. The vulnerability is remotely exploitable and requires user interaction. It carries a CVSS v3.1 base score of 8.8 (High) per NVD, while the CNA (VulDB) assigns a CVSS v4.0 score of 2.1 (Low) (Red Hat Advisory, GitHub Issue).

The root cause is a time-of-check/time-of-use (TOCTOU) race condition classified as CWE-122 (Heap-based Buffer Overflow) and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). When js_typed_array_constructor calls js_typed_array_constructor_ta with a typed array argument, it passes p->u.array.count as the length. However, within js_typed_array_constructor_ta, the call to js_create_from_ctor can trigger arbitrary JavaScript execution (e.g., via a Proxy trap), which may resize the underlying ArrayBuffer — invalidating the previously captured len value. The subsequent memcpy(abuf->data, src_abuf->data + ta->offset, abuf->byte_length) then reads beyond the now-shrunk buffer, causing a heap buffer overflow or use-after-free. A public PoC using Reflect.construct with a malicious Proxy that resizes a resizable ArrayBuffer to zero during construction was provided by the reporter (GitHub Issue, GitHub PR).

Successful exploitation can result in unauthorized read access to heap memory beyond the allocated buffer, potential memory corruption, application crashes (denial of service), and — depending on the deployment context — possible arbitrary code execution. The confidentiality, integrity, and availability of the host process are all at risk. Applications embedding quickjs-ng as a scripting engine (e.g., server-side runtimes, sandboxed environments) that process untrusted JavaScript input are most exposed (Red Hat Advisory, GitHub Issue).

A proof-of-concept exploit was publicly disclosed by the reporter (Mcsky23 / Vlad Ionut Seba) in the GitHub issue at the time of reporting on January 6, 2026, and is referenced as an exploit by NVD. There is no evidence of in-the-wild exploitation as of the available data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.049% (0.000490), indicating a low probability of exploitation in the near term. No threat actor attribution has been reported (GitHub Issue, Red Hat Advisory).

1. Identify a target: Locate an application or service that embeds quickjs-ng version ≤ 0.11.0 and evaluates untrusted or attacker-controlled JavaScript input.
2. Craft the malicious JavaScript payload: Construct a script that creates a resizable ArrayBuffer and a source Uint8Array backed by it, then defines a Proxy-based constructor whose prototype getter resizes the ArrayBuffer to zero before returning Uint8Array.prototype:

const rab = new ArrayBuffer(10, { maxByteLength: 10 });
const src = new Uint8Array(rab, 0);
const EvilConstructor = new Proxy(function(){}, {
  get: function(target, prop, receiver) {
    if (prop === 'prototype') {
      rab.resize(0); // shrink buffer, invalidating len
      return Uint8Array.prototype;
    }
    return Reflect.get(target, prop, receiver);
  }
});
let u8 = Reflect.construct(Uint8Array, [src], EvilConstructor);

3. Trigger the vulnerability: Submit the payload to the target application for evaluation. When js_typed_array_constructor_ta is called, js_create_from_ctor invokes the Proxy's get trap, which resizes the backing ArrayBuffer to 0 bytes, making the previously captured len stale.
4. Achieve heap buffer overflow: The subsequent memcpy in js_typed_array_constructor_ta reads abuf->byte_length bytes from the now-invalidated source buffer, triggering an out-of-bounds read on the heap — potentially leading to a crash or memory disclosure (GitHub Issue, GitHub PR).

• Process: Unexpected crashes or aborts of processes embedding quickjs-ng, particularly with AddressSanitizer output referencing js_typed_array_constructor_ta or memcpy in quickjs.c.
• Logs: Application error logs showing heap-buffer-overflow or ABORTING messages from ASan; stack traces referencing js_typed_array_constructor_ta, js_create_from_ctor, or js_reflect_construct.
• File System: Core dump files generated by the quickjs-ng host process following unexpected termination.
• Network: Delivery of JavaScript payloads containing patterns such as Reflect.construct, new Proxy, rab.resize(0), and Uint8Array in combination to endpoints that evaluate user-supplied scripts (GitHub Issue).

The fix was merged into the quickjs-ng master branch on January 6, 2026 via PR #1306 (commit 53aebe66170d545bb6265906fe4324e4477de8b4). The patch adds a bounds check in js_typed_array_constructor_ta that throws a RangeError if len > p->u.array.count after js_create_from_ctor returns, preventing the stale-length memcpy. Organizations should update quickjs-ng to any version beyond 0.11.0 that includes this commit. As an interim measure, restrict or sandbox untrusted JavaScript input processed by affected quickjs-ng versions and apply network segmentation to limit exposure (GitHub PR, Patch Commit).

Red Hat tracked the vulnerability via Bugzilla (ID 2430790) and published a CVE advisory page. The issue was noted on Bluesky via automated CVE tracking accounts. No significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability database aggregation (Red Hat Advisory).