Executive brief
Cesanta mJS is an embedded JavaScript engine used in C/C++ applications. A heap buffer overflow vulnerability in the tokenizer can crash any application that processes untrusted JavaScript code ending with whitespace, potentially allowing attackers to cause denial-of-service or trigger memory safety failures.
Technical details
The vulnerability is a heap-based buffer over-read (CWE-125) in the skip_spaces_and_comments() function in src/mjs_tok.c. When mjs_exec() is called with input ending in whitespace, the function attempts to read one byte past the null terminator by checking p->pos[1] without first verifying p->pos[0] != '\0'. The flaw is triggered during lexical analysis by any code path that calls mjs_exec() with untrusted JavaScript input. This requires no authentication or special privileges—any application embedding mJS is vulnerable if it accepts external JavaScript. The issue causes an out-of-bounds read (not a write), resulting in a crash under memory sanitizers and potentially information disclosure. The vendor was informed early but has not yet patched the issue.
Affected products
- Cesanta mJS up to 1.26
Timeline
- 2026-07-30: disclosed: Issue publicly reported on GitHub
- 2026-09-08: advisory: CVE-2026-86716 assigned and published