CVE-2025-69654: High severity quickjs vulnerability
A crafted JavaScript input executed with the QuickJS release 2025-09-13, fixed in commit fcd33c1afa7b3028531f53cd1190a3877454f6b3 (2025-12-11),qjs interpreter using the -m option and a low memory limit can cause an out-of-memory condition followed by an assertion failure in JSFreeRuntime (listempty(&rt->gcobjlist)) during runtime cleanup. Although the engine reports an OOM error, it subsequently aborts with SIGABRT because the GC object list is not fully released. This results in a denial of service.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-69654?
CVE-2025-69654 is considered a high severity vulnerability due to its potential for causing denial of service through an out-of-memory condition.
How do I fix CVE-2025-69654?
To fix CVE-2025-69654, upgrade to QuickJS version 2025-12-11 or later, as this version addresses the vulnerability.
What causes CVE-2025-69654?
CVE-2025-69654 is caused by the execution of crafted JavaScript input in the QuickJS interpreter with low memory limits, leading to an assertion failure.
What does CVE-2025-69654 affect?
CVE-2025-69654 specifically affects QuickJS version 2025-09-13 when run with the `-m` option under low memory conditions.
Is CVE-2025-69654 exploitable?
Yes, CVE-2025-69654 can be exploited to trigger an out-of-memory condition, resulting in application instability.