PatchTheCVEquickjs project vulnerabilities
Recent CVEs affecting quickjs project products. 10 tracked.
quickjs project has 10 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 10. Most recent: 2026-03-06. Highest priority: CVE-2025-62494 (score 47/100).
- CVE-2025-62496 HIGH 8.8 UPGRADE A vulnerability exists in the QuickJS engine's BigInt string parsing logic (js_bigint_from_string) when attemp
- CVE-2025-62494 HIGH 8.8 UPGRADE A type confusion vulnerability exists in the handling of the string addition (+) operation within the QuickJS
- CVE-2025-62495 HIGH 8.8 UPGRADE An integer overflow vulnerability exists in the QuickJS regular expression engine (libregexp) due to an incons
- CVE-2025-62490 HIGH 8.8 UPGRADE In quickjs, in js_print_object, when printing an array, the function first fetches the array length and then l
- CVE-2025-62491 HIGH 8.8 UPGRADE A Use-After-Free (UAF) vulnerability exists in the QuickJS engine's standard library when iterating over the g
- CVE-2025-62492 MEDIUM 6.5 UPGRADE A vulnerability stemming from floating-point arithmetic precision errors exists in the QuickJS engine's implem
- CVE-2025-62493 MEDIUM 6.5 UPGRADE A vulnerability exists in the QuickJS engine's BigInt string conversion logic (js_bigint_to_string1) due to an
- CVE-2025-69654 HIGH 7.5 UPGRADE A crafted JavaScript input executed with the QuickJS release 2025-09-13, fixed in commit fcd33c1afa7b3028531f5
- CVE-2025-69653 MEDIUM 6.5 UPGRADE A crafted JavaScript input can trigger an internal assertion failure in QuickJS release 2025-09-13, fixed in c
- CVE-2025-46688 MEDIUM 5.6 UPGRADE UPGRADE quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-ba
FAQ
How do I fix quickjs project vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is quickjs project being exploited right now?
None of the tracked quickjs project CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which quickjs project CVE should I patch first?
CVE-2025-62494 currently ranks highest (47/100): A type confusion vulnerability exists in the handling of the string addition (+) operation within the QuickJS .