PatchTheCVEluajit vulnerabilities and fixes
Recent CVEs affecting luajit, with upgrade or downgrade steps. 3 tracked.
luajit has 3 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 3. Most recent: 2025-07-07. Highest priority: CVE-2024-25176 (score 56/100).
- CVE-2024-25178 CRITICAL 9.1 UPGRADE LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an out-of-bounds read in the stack-overflow
- CVE-2024-25177 HIGH 7.5 UPGRADE LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an unsinking of IR_FSTORE for NULL metatabl
- CVE-2024-25176 CRITICAL 9.8 UPGRADE LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240626 have a stack-buffer-overflow in lj_strfmt_wfnum
FAQ
How do I fix luajit vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is luajit being exploited right now?
None of the tracked luajit CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which luajit CVE should I patch first?
CVE-2024-25176 currently ranks highest (56/100): LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240626 have a stack-buffer-overflow in lj_strfmt_wfnum .