CVE-2025-69653: 
NixOS vulnerability analysis and mitigation

CVE-2025-69653 is a Denial-of-Service vulnerability in the QuickJS JavaScript interpreter caused by a reachable assertion failure (CWE-617) in the garbage collector. A crafted JavaScript input, when executed with the qjs interpreter using the -m (module) option, triggers an internal assertion failure in the gc_decref_child function in quickjs.c, causing the process to abort with SIGABRT. The vulnerability affects QuickJS release 2025-09-13 up to (but not including) the fix committed on 2025-12-11 (commit 1dbba8a88eaa40d15a8a9b70bb1a0b8fb5b552e6). It carries a CVSS v3.1 base score of 6.5 (Medium) (Red Hat CVE, GitHub Issue).

The root cause is a reachable assertion (CWE-617) in the gc_decref_child function within quickjs.c at line 6273, where the assertion p->ref_count > 0 fails during garbage collection. This occurs when a specially crafted JavaScript module is loaded via the -m flag, causing an inconsistent reference count state in the GC object graph. The crash propagates through the call stack: JS_RunGC → gc_decref → mark_children → gc_decref_child, ultimately invoking abort(). A proof-of-concept input file (discovered via fuzzing with honggfuzz) that reliably triggers the crash has been publicly disclosed in the GitHub issue (GitHub Issue).

Successful exploitation results in a complete denial of service for the qjs interpreter process — the process terminates abnormally via SIGABRT with no recovery. There is no impact on confidentiality or integrity (CVSS scores both as None). Any application or service that processes untrusted JavaScript input using QuickJS with the -m option is at risk of being crashed by a malicious actor, potentially disrupting service availability (Red Hat CVE, GitHub Issue).

A proof-of-concept exploit (a crafted input file) is publicly available via the GitHub issue tracker, discovered through fuzzing. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term (GitHub Issue, Red Hat CVE).

1. Obtain PoC: Retrieve or craft a malicious JavaScript module file (e.g., as demonstrated in the public PoC attached to GitHub Issue #467, discovered via honggfuzz fuzzing).
2. Identify target: Locate a system or service running a vulnerable version of QuickJS (release 2025-09-13 through 2025-12-10) that processes user-supplied JavaScript files with the qjs -m option.
3. Deliver payload: Provide the crafted JavaScript file as input to the qjs interpreter invoked with the -m flag: ./qjs -m <crafted_file.js>.
4. Trigger crash: The malformed module causes an inconsistent reference count in the garbage collector. During GC execution, the assertion p->ref_count > 0 in gc_decref_child fails, triggering abort() and terminating the process with SIGABRT, achieving denial of service (GitHub Issue).

• Process: Unexpected termination of qjs processes with SIGABRT (signal 6); core dump files generated by the qjs process in the working directory.
• Logs: System logs (e.g., /var/log/syslog or journalctl) showing entries like qjs: quickjs.c:6273: void gc_decref_child(JSRuntime *, JSGCObjectHeader *): Assertion 'p->ref_count > 0' failed.
• File System: Presence of unexpected or externally supplied .js files being passed to qjs -m; core dump files (e.g., core.*) in directories where qjs is executed.
• Network: Unusual inbound delivery of JavaScript files to services that invoke qjs -m on user-supplied content (GitHub Issue).

Update QuickJS to a version incorporating commit 1dbba8a88eaa40d15a8a9b70bb1a0b8fb5b552e6 (dated 2025-12-11) or any release after 2025-12-11. As an interim workaround, restrict or disable the use of the qjs interpreter with the -m option in any environment that processes untrusted or externally supplied JavaScript input. Additionally, sandboxing or isolating the qjs process can limit the impact of a crash on broader system availability (GitHub Issue, Red Hat CVE).