PatchTheCVEquickjs-ng vulnerabilities
Recent CVEs affecting quickjs-ng products. 4 tracked.
quickjs-ng has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2026-01-19. Highest priority: CVE-2026-1145 (score 36/100).
- CVE-2026-1145 MEDIUM 6.3 UPGRADE A flaw has been found in quickjs-ng quickjs up to 0.11.0
- CVE-2026-1144 MEDIUM 6.3 UPGRADE A vulnerability was detected in quickjs-ng quickjs up to 0.11.0
- CVE-2025-46688 MEDIUM 5.6 UPGRADE UPGRADE quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-ba
- CVE-2025-46687 MEDIUM 5.6 UPGRADE UPGRADE quickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a heap-based buf
FAQ
How do I fix quickjs-ng vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is quickjs-ng being exploited right now?
None of the tracked quickjs-ng CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which quickjs-ng CVE should I patch first?
CVE-2026-1145 currently ranks highest (36/100): A flaw has been found in quickjs-ng quickjs up to 0.11.0.