A crafted JavaScript input executed with the QuickJS release 2025-09-13, fixed in commit fcd33c1afa7b3028531f53cd1190a3877454f6b3 (2025-12-11),`qjs` interpreter using the `-m` option and a low memory limit can cause an out-of-memory condition followed by an assertion failure in JS_FreeRuntime (list_empty(&rt->gc_obj_list)) during runtime cleanup. Although the engine reports an OOM error, it subsequently aborts with SIGABRT because the GC object list is not fully released. This results in a denial of service.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/bellard/quickjs/issues/468 |
Configurations
No configuration.
History
06 Mar 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-06 20:16
Updated : 2026-03-06 20:16
NVD link : CVE-2025-69654
Mitre link : CVE-2025-69654
CVE.ORG link : CVE-2025-69654
JSON object : View
Products Affected
No product.
CWE
No CWE.