CVE catalog
CVE-2026-0821
UBUNTU-CVE-2026-0821
- Severity
- High · CVSS 7.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.52% · Oct 25, 2026
A vulnerability was determined in quickjs-ng quickjs up to 0.11.0. This vulnerability affects the function js_typed_array_constructor of the file quickjs.c. Executing a manipulation can lead to heap-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called c5d80831e51e48a83eab16ea867be87f091783c5. A patch should be applied to remediate this issue.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | quickjs | 13 | 2025.04.26-1 | vulnerable |
| Debian | quickjs | 14 | 2025.04.26-1 | vulnerable |
| Alpine | quickjs-ng | 3.23 | 0.11.0-r1 | fixed |
| Alpine | quickjs-ng | 3.24 | 0.11.0-r2 | fixed |
| Ubuntu | quickjs | pro | 2021.03.27-1 | vulnerable |
| Ubuntu | quickjs | pro | 2021.03.27-1ubuntu0.1~esm1 | vulnerable |
| Ubuntu | quickjs | 25.10 | 2024.01.13-5 | vulnerable |
| Ubuntu | quickjs | 25.10 | 2025.04.26-1 | vulnerable |
| Ubuntu | quickjs | 26.04 | 2025.04.26-1 | vulnerable |
| Ubuntu | quickjs | 26.04 | 2025.04.26-1build1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Alpine | quickjs-ng | apk | 3.23 | 0.11.0-r1 | Not reported | ALPINE-CVE-2026-0821 | Not reported |
| Alpine | quickjs-ng | apk | 3.24 | 0.11.0-r2 | Not reported | ALPINE-CVE-2026-0821 | Not reported |
OpenFactory catalog packages
[Debian 13 (Trixie)]
- [libquickjs]Affected
Source package: [quickjs]
Details (2)
2025.04.26-1· amd64 · trixieAffected
pypi · quickjs · debian · 13
2025.04.26-1· arm64 · trixieAffected
pypi · quickjs · debian · 13
- [quickjs]Affected
Details (2)
2025.04.26-1· amd64 · trixieAffected
pypi · quickjs · debian · 13
2025.04.26-1· arm64 · trixieAffected
pypi · quickjs · debian · 13
Observed:
References
- [https://osv.dev/vulnerability/ALPINE-CVE-2026-0821]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-0821]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-0821]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0821.json]
[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]