Denial of Service Vulnerability in QuickJS by Belleard
CVE-2025-69653

6.5MEDIUM

Key Information:

Vendor

Bellard

Status
QuickJS
Vendor
CVE Published:
6 March 2026

What is CVE-2025-69653?

A crafted input in JavaScript can cause an internal assertion failure in QuickJS, specifically in versions released on 2025-09-13. When this crafted input is executed using the qjs interpreter with the -m option, it triggers a SIGABRT during the garbage collection process, leading to a denial-of-service condition. The issue has been addressed in a subsequent commit on 2025-12-11.

References

https://github.com/bellard/quickjs/issues/467

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.