PatchTheCVECVE-2025-62495: An integer overflow vulnerability exists in the QuickJS regular expression engine (libregexp) due to an incons
CVE-2025-62495 is a high-severity flaw (CVSS 8.8) affecting quickjs. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An integer overflow vulnerability exists in the QuickJS regular expression engine (libregexp) due to an inconsistent representation of the bytecode buffer size. * The regular expression bytecode is stored in a DynBuf structure, which correctly uses a $\text{size}\_\text{t}$ (an unsigned type, typically 64-bit) for its size member. * However, several functions, such as re_emit_op_u32 and other internal parsing routines, incorrectly cast o
Why this priority
- High severity
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.8 (High) |
| Attack vector | Adjacent network |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.5% (top 60%) |
| CISA exploited list | No |
| Weakness | CWE-191 |
| Published | 2025-10-16 |
| Last modified | 2026-10-19 |
Last updated 2026-10-19 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-62495?
quickjs: upgrade to 2025-09-13. Exact commands for each OS are on this page.
Is CVE-2025-62495 being exploited?
CVE-2025-62495 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-62495 affect?
CVE-2025-62495 affects quickjs. Severity is high (CVSS 8.8). An integer overflow vulnerability exists in the QuickJS regular expression engine (libregexp) due to an inconsistent representation of the bytecode buffer size. * The regular expression bytecode is stored in a DynBuf structure, which co
How urgent is CVE-2025-62495?
Priority 46/100. High severity; Public exploit reference
Related CVEs
- CVE-2025-62496 HIGH 8.8 UPGRADE A vulnerability exists in the QuickJS engine's BigInt string parsing logic (js_bigint_from_string) when attemp
- CVE-2025-62494 HIGH 8.8 UPGRADE A type confusion vulnerability exists in the handling of the string addition (+) operation within the QuickJS
- CVE-2025-62490 HIGH 8.8 UPGRADE In quickjs, in js_print_object, when printing an array, the function first fetches the array length and then l
- CVE-2025-62491 HIGH 8.8 UPGRADE A Use-After-Free (UAF) vulnerability exists in the QuickJS engine's standard library when iterating over the g
- CVE-2025-62492 MEDIUM 6.5 UPGRADE A vulnerability stemming from floating-point arithmetic precision errors exists in the QuickJS engine's implem