Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
QuickJS Interpreter Crashes with Out-of-Memory Error
CVE-2025-69654
Summary
The QuickJS JavaScript interpreter can crash if it encounters a malicious script while running with a low memory limit. This can cause the interpreter to stop working and become unresponsive. To fix this, update to the latest version of QuickJS, which includes a patch for this issue.
Original title
A crafted JavaScript input executed with the QuickJS release 2025-09-13, fixed in commit fcd33c1afa7b3028531f53cd1190a3877454f6b3 (2025-12-11),`qjs` interpreter using the `-m` option and a low memo...
Original description
A crafted JavaScript input executed with the QuickJS release 2025-09-13, fixed in commit fcd33c1afa7b3028531f53cd1190a3877454f6b3 (2025-12-11),`qjs` interpreter using the `-m` option and a low memory limit can cause an out-of-memory condition followed by an assertion failure in JS_FreeRuntime (list_empty(&rt->gc_obj_list)) during runtime cleanup. Although the engine reports an OOM error, it subsequently aborts with SIGABRT because the GC object list is not fully released. This results in a denial of service.
Vulnerability type
CWE-400
Uncontrolled Resource Consumption
Published: 6 Mar 2026 · Updated: 13 Mar 2026 · First seen: 6 Mar 2026