CVE-2026-0821

A vulnerability was determined in quickjs-ng quickjs up to 0.11.0. This vulnerability affects the function js_typed_array_constructor of the file quickjs.c. Executing a manipulation can lead to heap-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called c5d80831e51e48a83eab16ea867be87f091783c5. A patch should be applied to remediate this issue.

• CWE-119
• CWE-122

• https://github.com/quickjs-ng/quickjs/
• https://github.com/quickjs-ng/quickjs/commit/c5d80831e51e48a83eab16ea867be87f091783c5Patch
• https://github.com/quickjs-ng/quickjs/issues/1296Exploit, Issue Tracking, Vendor Advisory
• https://github.com/quickjs-ng/quickjs/issues/1296#issue-3780003395Exploit, Issue Tracking, Vendor Advisory
• https://github.com/quickjs-ng/quickjs/pull/1299Issue Tracking
• https://vuldb.com/?ctiid.340355Permissions Required, VDB Entry
• https://vuldb.com/?id.340355Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.731780Third Party Advisory, VDB Entry

Published

Jan 10, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-0815The Category Image plugin for WordPress is vulnerable to Sto…4.4
• CVE-2026-0816The All push notification for WP plugin for WordPress is vul…4.9
• CVE-2026-0817Missing Authorization vulnerability in Wikimedia Foundation …5.3
• CVE-2026-0818When a user explicitly requested Thunderbird to decrypt an i…4.3
• CVE-2026-0819A stack buffer overflow vulnerability exists in wolfSSL's PK…7.1
• CVE-2026-0820The RepairBuddy – Repair Shop CRM & Booking Plugin for WordP…4.3
• CVE-2026-0822A vulnerability was identified in quickjs-ng quickjs up to 0…8.8
• CVE-2026-0823Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-0824A security flaw has been discovered in questdb ui up to 1.11…3.5
• CVE-2026-0825The Database for Contact Form 7, WPforms, Elementor forms pl…5.3
• CVE-2026-0826In certain scenarios when the admin has enabled Interactive …9.2
• CVE-2026-0827During an internal security assessment, a potential vulnerab…7.1