CVE-2026-120438 QuickJS-NG before 0.16.0 Heap Buffer Overflow via Proxy ownKeys Enumeration

QuickJS-NG before 0.16.0 contains an integer overflow in jsproxygetownpropertynames in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the allocation size, causing crashes or potentia...

CVE-2026-120438

The QuickJS-NG JavaScript engine (versions before 0.16.0 ) is vulnerable to a heap buffer overflow on 32-bit hosts due to an integer overflow in the js_proxy_get_own_property_names() function within quickjs.c. An attacker running JavaScript can trigger this by returning a large array-like object ...

PT-2026-135454

QuickJS-NG before 0.16.0 contains an integer overflow in js proxy get own property names in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the allocation size, causing crashes or...