CVE-2025-69654 is a denial-of-service vulnerability in the QuickJS JavaScript engine, specifically in the 2025-09-13 release. The issue arises when a specially crafted JavaScript input is executed using the `-m` command-line option with a low memory limit. Under these conditions, the engine encounters an out-of-memory (OOM) error during execution. Although the engine correctly reports the OOM condition, it subsequently fails during the runtime cleanup phase in the JS_FreeRuntime function. This failure is due to an assertion triggered by the garbage collector's object list not being empty (list_empty(&rt->gc_obj_list) assertion failure). As a result, the interpreter aborts with a SIGABRT signal, causing an abrupt termination of the process. This behavior leads to a denial of service, as the affected QuickJS interpreter instance cannot continue running. The vulnerability does not compromise confidentiality or integrity but severely impacts availability. Exploitation requires no privileges or user interaction and can be triggered remotely if the QuickJS interpreter is exposed. The vulnerability is tracked under CWE-400 (Uncontrolled Resource Consumption). The issue was fixed in a commit dated 2025-12-11 (commit fcd33c1afa7b3028531f53cd1190a3877454f6b3). No public exploits are known at this time, but the CVSS v3.1 base score is 7.5, reflecting high severity due to ease of exploitation and impact on availability.

The primary impact of CVE-2025-69654 is denial of service, which can disrupt applications or services relying on the QuickJS engine for JavaScript execution. Organizations embedding QuickJS in constrained environments, such as IoT devices, edge computing platforms, or lightweight server-side applications, are particularly at risk. An attacker can remotely trigger the vulnerability without authentication or user interaction, causing the interpreter to abort unexpectedly and potentially leading to service outages or system instability. This could affect critical infrastructure components that depend on QuickJS for scripting or automation, resulting in operational downtime and potential cascading failures. Although no data confidentiality or integrity is compromised, the loss of availability can impact business continuity, user experience, and trust. The vulnerability's ease of exploitation and lack of prerequisites increase the risk of widespread attacks once exploit code becomes available.

To mitigate CVE-2025-69654, organizations should immediately update QuickJS to the fixed version released after the 2025-12-11 commit (fcd33c1afa7b3028531f53cd1190a3877454f6b3). If upgrading is not immediately feasible, consider implementing strict input validation and sandboxing to limit the execution of untrusted JavaScript code, especially when using the `-m` option. Monitor resource usage closely and configure memory limits conservatively to avoid low-memory conditions that trigger the vulnerability. Employ runtime monitoring and alerting for abnormal process terminations or SIGABRT signals in systems running QuickJS. For embedded or IoT devices, ensure secure update mechanisms are in place to deploy patches promptly. Additionally, restrict network exposure of services using QuickJS to trusted environments to reduce the attack surface. Finally, maintain incident response plans to quickly address potential denial-of-service incidents related to this vulnerability.