What’s Vulnerable › Vulnerabilities

CVE-2025-69654

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-06 · updated 2026-06-17
• Weakness: CWE-400

Description

A crafted JavaScript input executed with the QuickJS release 2025-09-13, fixed in commit fcd33c1afa7b3028531f53cd1190a3877454f6b3 (2025-12-11),`qjs` interpreter using the `-m` option and a low memory limit can cause an out-of-memory condition followed by an assertion failure in JS_FreeRuntime (list_empty(&rt->gc_obj_list)) during runtime cleanup. Although the engine reports an OOM error, it subsequently aborts with SIGABRT because the GC object list is not fully released. This results in a denial of service.

Affected products

• QuickJS: from 2025-09-13 before 2025-12-11 — fixed in 2025-12-11

How to fix

Upgrade to a fixed version: QuickJS 2025-12-11. Check the vendor advisory for mitigations.

References

• https://github.com/bellard/quickjs/issues/468
• https://github.com/bellard/quickjs/issues/468

Get alerted when CVE-2025-69654 or the next vulnerability affects your stack