quickjs{,-ng}: react to CVE-2026-1144 and CVE-2026-1145 (#484886)

pkgs/by-name/qu/quickjs-ng/package.nix

@@ -2,6 +2,7 @@
   lib,
   cmake,
   fetchFromGitHub,
+  fetchpatch,
   stdenv,
   testers,
   texinfo,
@@ -18,6 +19,24 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-Mb0YyxTWU6a8HFTVBmlJ5yGEDmjKXHqTSszAvb8Y01U=";
   };
 
+  patches = [
+    # CVE-2026-1145: Fix heap buffer overflow in js_typed_array_constructor_ta
+    # https://github.com/quickjs-ng/quickjs/issues/1305
+    (fetchpatch {
+      name = "CVE-2026-1145.patch";
+      url = "https://github.com/quickjs-ng/quickjs/commit/53aebe66170d545bb6265906fe4324e4477de8b4.patch";
+      hash = "sha256-PObMEqIush07mQ7YcoFUJ3rXitOlEU0tCsgVi6P2zW0=";
+    })
+    # CVE-2026-1144: Fix OOB access in atomic ops
+    # https://github.com/quickjs-ng/quickjs/issues/1301
+    # https://github.com/quickjs-ng/quickjs/issues/1302
+    (fetchpatch {
+      name = "CVE-2026-1144.patch";
+      url = "https://github.com/quickjs-ng/quickjs/commit/ea3e9d77454e8fc9cb3ef3c504e9c16af5a80141.patch";
+      hash = "sha256-ph6U+Mz7gxR4RWEtc+XU5fO6qjApQTqqW5dzwnOqTdc=";
+    })
+  ];
+
   outputs = [
     "out"
     "bin"

pkgs/by-name/qu/quickjs/package.nix

@@ -121,5 +121,10 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = [ ];
     mainProgram = "qjs";
     platforms = lib.platforms.all;
+    # Pending upstream fix: https://github.com/bellard/quickjs/pull/483
+    knownVulnerabilities = [
+      "CVE-2026-1144"
+      "CVE-2026-1145"
+    ];
   };
 })