CVE-2026-120440
Medium · 5.3CVSS
5.3
EPSS
0.5%
Published
Nov 2, 2026
CISA due date
—
The record
QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the converted value when returning a RangeError. Attackers running JavaScript can repeatedly call Atomics.store with a valueOf that detaches or shrinks the buffer to exhaust heap memory and cause denial of service.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-120678 A memory management flaw in the MongoDB C Driver's handling of compressed responses may… CWE-401
- CVE-2026-121512 Memory Leak with Amplification in µD3TN BPv6 EID Reference Handling allows… CWE-401
- CVE-2026-119286 GraphQL-core is a Python port of the GraphQL.js reference implementation. CWE-401
- CVE-2026-116157 ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails… CWE-401
- CVE-2026-116158 ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare… CWE-401
- CVE-2026-116159 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the… CWE-401
- CVE-2026-116156 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak caused by a… CWE-401
- CVE-2026-116151 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the JNG… CWE-401