CVE-2025-69654

7.5 HIGH

A crafted JavaScript input executed with the QuickJS release 2025-09-13, fixed in commit fcd33c1afa7b3028531f53cd1190a3877454f6b3 (2025-1...

Published: 2026-03-06 · Last updated: 2026-06-02

Severity and scoring

CVSS: 7.5 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE: CWE-400

Affected products

Vendor	Product
quickjs_project	quickjs

Description

A crafted JavaScript input executed with the QuickJS release 2025-09-13, fixed in commit fcd33c1afa7b3028531f53cd1190a3877454f6b3 (2025-12-11),`qjs` interpreter using the `-m` option and a low memory limit can cause an out-of-memory condition followed by an assertion failure in JS_FreeRuntime (list_empty(&rt->gc_obj_list)) during runtime cleanup. Although the engine reports an OOM error, it subsequently aborts with SIGABRT because the GC object list is not fully released. This results in a denial of service.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2025-69654
[Vendor advisory]https://github.com/bellard/quickjs/issues/468
[Vendor advisory]https://github.com/bellard/quickjs/issues/468

Related CVEs

Same vendor

CVE-2025-69653 — A crafted JavaScript input can trigger an internal assertion failure in QuickJS release 2025-09-13, fixed in commit 1dbba8a88eaa40d15a8a9... (6.5 MEDIUM)

Same CWE

CVE-2026-12325 — Denial-of-service in the Graphics: ImageLib component (6.5 MEDIUM)
CVE-2026-12319 — Denial-of-service in the Audio/Video: Playback component (6.5 MEDIUM)
CVE-2026-50889 — An input handling flaw in the HTTP refresh token process of LLDAP v0.6.2 allows attackers to cause a Denial of Service (DoS) via sending ... (7.5 HIGH)
CVE-2026-50882 — An issue in the /api/v0/pastes endpoint of anna-is-cute paste v0.1.1 allows attackers to cause a Denial of Service (DoS) via a crafted PO... (7.5 HIGH)
CVE-2026-50879 — An issue in the uploadPostHandler component of Andrei Marcu linx-server v2.3.8 allows attackers to cause a Denial of Service (DoS) via a ... (7.5 HIGH)