High severity · published Sep 8, 2026
CVE-2026-86716
Cesanta mJS mjs_tok.c skip_spaces_and_comments heap-based overflow
7.3
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability was determined in Cesanta mJS up to 1.26. Affected is the function skip_spaces_and_comments of the file src/mjs_tok.c. Executing a manipulation can lead to heap-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MJ
mJS · Cesanta
1.0; 1.1; 1.2; 1.3; 1.4; 1.5; +21 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86716
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86716
github.com
https://github.com/cesanta/mjs/
github.com
https://github.com/cesanta/mjs/issues/324
vuldb.com
https://vuldb.com/cve/CVE-2026-86716
vuldb.com
https://vuldb.com/submit/910881
vuldb.com
https://vuldb.com/submit/910882
vuldb.com
https://vuldb.com/vuln/399773
More from mJS
9.8
CVE-2023-50044
Cesanta MJS 2.20.0 has a getprop_builtin_foreign out-of-bounds read if a Built-in API name occurs in a substring of an input string
9.8
CVE-2023-43338
Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability via the function mjs_get_ptr()
7.8
CVE-2021-46527
Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via mjs_get_cstring at src/mjs_string.c
7.8
CVE-2021-46526
Cesanta MJS v2.20.0 was discovered to contain a global buffer overflow via snquote at src/mjs_json.c
7.8
CVE-2021-46525
Cesanta MJS v2.20.0 was discovered to contain a heap-use-after-free via mjs_apply at src/mjs_exec.c