https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-69654.htmlhttps://patchthecve.com/cve/CVE-2025-69654.htmlWed, 17 Jun 2026 10:00:49 +0000HIGH 7.5: A crafted JavaScript input executed with the QuickJS release 2025-09-13, fixed in commit fcd33c1afa7b3028531f53cd1190a3877454f6b3 (2025-12-11),`qjs` interpreter using the `-m` option and a low memory limit can cause an out-of-memory condition followed by an assertion failure in JS_FreeRuntime (list_https://patchthecve.com/cve/CVE-2025-69653.htmlhttps://patchthecve.com/cve/CVE-2025-69653.htmlWed, 17 Jun 2026 10:00:49 +0000MEDIUM 6.5: A crafted JavaScript input can trigger an internal assertion failure in QuickJS release 2025-09-13, fixed in commit 1dbba8a88eaa40d15a8a9b70bb1a0b8fb5b552e6 (2025-12-11), in file gc_decref_child in quickjs.c, when executed with the qjs interpreter using the -m option. This leads to an abort (SIGABRThttps://patchthecve.com/cve/CVE-2025-62496.htmlhttps://patchthecve.com/cve/CVE-2025-62496.htmlMon, 19 Oct 2026 17:10:00 +0000HIGH 8.8: A vulnerability exists in the QuickJS engine's BigInt string parsing logic (js_bigint_from_string) when attempting to create a BigInt from a string with an excessively large number of digits. The function calculates the necessary number of bits (n_bits) required to store the BigInt using the formulhttps://patchthecve.com/cve/CVE-2025-62495.htmlhttps://patchthecve.com/cve/CVE-2025-62495.htmlMon, 19 Oct 2026 16:10:00 +0000HIGH 8.8: An integer overflow vulnerability exists in the QuickJS regular expression engine (libregexp) due to an inconsistent representation of the bytecode buffer size. * The regular expression bytecode is stored in a DynBuf structure, which correctly uses a $\text{size}\_\text{t}$ (an unsigned type, tyhttps://patchthecve.com/cve/CVE-2025-62494.htmlhttps://patchthecve.com/cve/CVE-2025-62494.htmlMon, 19 Oct 2026 16:10:00 +0000HIGH 8.8: A type confusion vulnerability exists in the handling of the string addition (+) operation within the QuickJS engine. * The code first checks if the left-hand operand is a string. * It then attempts to convert the right-hand operand to a primitive value using JS_ToPrimitiveFree. This converhttps://patchthecve.com/cve/CVE-2025-62493.htmlhttps://patchthecve.com/cve/CVE-2025-62493.htmlMon, 19 Oct 2026 16:10:00 +0000MEDIUM 6.5: A vulnerability exists in the QuickJS engine's BigInt string conversion logic (js_bigint_to_string1) due to an incorrect calculation of the required number of digits, which in turn leads to reading memory past the allocated BigInt structure. * The function determines the number of characters (n_https://patchthecve.com/cve/CVE-2025-62492.htmlhttps://patchthecve.com/cve/CVE-2025-62492.htmlMon, 19 Oct 2026 16:10:00 +0000MEDIUM 6.5: A vulnerability stemming from floating-point arithmetic precision errors exists in the QuickJS engine's implementation of TypedArray.prototype.indexOf() when a negative fromIndex argument is supplied. * The fromIndex argument (read as a double variable, $d$) is used to calculate the starting poshttps://patchthecve.com/cve/CVE-2025-62491.htmlhttps://patchthecve.com/cve/CVE-2025-62491.htmlMon, 19 Oct 2026 16:10:00 +0000HIGH 8.8: A Use-After-Free (UAF) vulnerability exists in the QuickJS engine's standard library when iterating over the global list of unhandled rejected promises (ts->rejected_promise_list). * The function js_std_promise_rejection_check attempts to iterate over the rejected_promise_list to report unhandlehttps://patchthecve.com/cve/CVE-2025-62490.htmlhttps://patchthecve.com/cve/CVE-2025-62490.htmlMon, 19 Oct 2026 16:10:00 +0000HIGH 8.8: In quickjs, in js_print_object, when printing an array, the function first fetches the array length and then loops over it. The issue is, printing a value is not side-effect free. An attacker-defined callback could run during js_print_value, during which the array could get resized and len1 become ohttps://patchthecve.com/cve/CVE-2025-46688.htmlhttps://patchthecve.com/cve/CVE-2025-46688.htmlWed, 17 Jun 2026 09:26:49 +0000MEDIUM 5.6: quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected.