PatchTheCVEquickjs vulnerabilities and fixes
Recent CVEs affecting quickjs, with upgrade or downgrade steps. 14 tracked.
quickjs has 14 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 14. Most recent: 2026-03-06. Highest priority: CVE-2025-62494 (score 47/100).
- CVE-2025-62496 HIGH 8.8 UPGRADE A vulnerability exists in the QuickJS engine's BigInt string parsing logic (js_bigint_from_string) when attemp
- CVE-2025-62494 HIGH 8.8 UPGRADE A type confusion vulnerability exists in the handling of the string addition (+) operation within the QuickJS
- CVE-2025-62495 HIGH 8.8 UPGRADE An integer overflow vulnerability exists in the QuickJS regular expression engine (libregexp) due to an incons
- CVE-2025-62490 HIGH 8.8 UPGRADE In quickjs, in js_print_object, when printing an array, the function first fetches the array length and then l
- CVE-2025-62491 HIGH 8.8 UPGRADE A Use-After-Free (UAF) vulnerability exists in the QuickJS engine's standard library when iterating over the g
- CVE-2025-62492 MEDIUM 6.5 UPGRADE A vulnerability stemming from floating-point arithmetic precision errors exists in the QuickJS engine's implem
- CVE-2025-62493 MEDIUM 6.5 UPGRADE A vulnerability exists in the QuickJS engine's BigInt string conversion logic (js_bigint_to_string1) due to an
- CVE-2025-12745 MEDIUM 5.3 UPGRADE A weakness has been identified in QuickJS up to eb2c89087def1829ed99630cb14b549d7a98408c
- CVE-2026-1145 MEDIUM 6.3 UPGRADE A flaw has been found in quickjs-ng quickjs up to 0.11.0
- CVE-2026-1144 MEDIUM 6.3 UPGRADE A vulnerability was detected in quickjs-ng quickjs up to 0.11.0
- CVE-2025-69654 HIGH 7.5 UPGRADE A crafted JavaScript input executed with the QuickJS release 2025-09-13, fixed in commit fcd33c1afa7b3028531f5
- CVE-2025-69653 MEDIUM 6.5 UPGRADE A crafted JavaScript input can trigger an internal assertion failure in QuickJS release 2025-09-13, fixed in c
- CVE-2025-46688 MEDIUM 5.6 UPGRADE UPGRADE quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-ba
- CVE-2025-46687 MEDIUM 5.6 UPGRADE UPGRADE quickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a heap-based buf
FAQ
How do I fix quickjs vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is quickjs being exploited right now?
None of the tracked quickjs CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which quickjs CVE should I patch first?
CVE-2025-62494 currently ranks highest (47/100): A type confusion vulnerability exists in the handling of the string addition (+) operation within the QuickJS .