CVE-2025-69654: 
NixOS vulnerability analysis and mitigation

CVE-2025-69654 is a Denial of Service vulnerability in the QuickJS JavaScript interpreter caused by uncontrolled resource consumption (CWE-400). When the qjs interpreter is invoked with the -m flag and a low memory limit, a crafted JavaScript input triggers an out-of-memory (OOM) condition followed by an assertion failure in JS_FreeRuntime (list_empty(&rt->gc_obj_list)), causing the process to abort with SIGABRT. The vulnerability affects QuickJS release 2025-09-13 up to (but not including) the fix committed on 2025-12-11 (commit fcd33c1afa7b3028531f53cd1190a3877454f6b3). It carries a CVSS v3.1 base score of 7.5 (High) (Red Hat Advisory, GitHub Issue).

The root cause is improper handling of the OOM error path during runtime cleanup (CWE-400: Uncontrolled Resource Consumption). When QuickJS exhausts its memory budget under the -m --memory-limit constraint, the garbage collector fails to fully drain the GC object list (rt->gc_obj_list) before JS_FreeRuntime is called. The subsequent assertion list_empty(&rt->gc_obj_list) at quickjs.c:2036 fails, triggering SIGABRT. Exploitation requires no authentication or user interaction — an attacker only needs to supply a crafted JavaScript file to a qjs process running with a memory limit. A public proof-of-concept (PoC) input file is available via the GitHub issue (GitHub Issue).

Successful exploitation results in a complete crash of the QuickJS interpreter process, causing a denial of service. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Any service or application that passes untrusted JavaScript input to a memory-limited qjs instance is at risk of being crashed by a remote, unauthenticated attacker without user interaction (Red Hat Advisory, GitHub Issue).

A public proof-of-concept is available on GitHub, consisting of a crafted input file (PoC.zip) and a specific command line (./qjs -m --memory-limit 1M Assertion_Failure) that reliably reproduces the crash. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.018% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Issue, Red Hat Advisory).

1. Identify target: Locate a service or application that passes user-supplied or network-supplied JavaScript to the qjs interpreter with the -m (module mode) flag and a low memory limit (e.g., --memory-limit 1M).
2. Prepare payload: Craft or obtain a JavaScript input file designed to exhaust the interpreter's memory budget during execution. The public PoC (PoC.zip) from the GitHub issue contains a working example.
3. Submit crafted input: Deliver the crafted JavaScript file to the target qjs process, either directly via command line or through an application interface that invokes qjs.
4. Trigger OOM and assertion failure: The interpreter processes the input, hits the memory limit, reports InternalError: out of memory, and then aborts with Assertion 'list_empty(&rt->gc_obj_list)' failed in JS_FreeRuntime at quickjs.c:2036.
5. Achieve DoS: The qjs process terminates with SIGABRT, crashing the interpreter and any dependent service (GitHub Issue).

• Process: qjs process terminating unexpectedly with SIGABRT; core dumps from the qjs binary referencing quickjs.c:2036.
• Logs: System logs (e.g., /var/log/syslog) showing entries like qjs: quickjs.c:2036: void JS_FreeRuntime(JSRuntime *): Assertion 'list_empty(&rt->gc_obj_list)' failed; application logs showing repeated InternalError: out of memory messages from qjs.
• File System: Presence of unexpected JavaScript files submitted to the interpreter, particularly those with unusual or obfuscated content designed to exhaust memory.
• Network: Repeated or automated submissions of JavaScript payloads to any network-facing service that invokes qjs with memory limits (GitHub Issue).

Update QuickJS to a version that includes commit fcd33c1afa7b3028531f53cd1190a3877454f6b3, dated 2025-12-11 or later. If immediate patching is not possible, avoid running qjs with the -m flag and low --memory-limit values in production environments exposed to untrusted input. Additionally, implement input validation or sandboxing to reject or isolate potentially malicious JavaScript payloads before they reach the interpreter (GitHub Issue, Red Hat Advisory).

Red Hat has published a security advisory tracking this CVE, and INCIBE-CERT (Spain's national cybersecurity incident response team) has issued an early warning alert. Tenable has added detection via Nessus plugin 301661. No significant researcher commentary or social media discussion has been identified beyond standard vulnerability database entries (Red Hat Advisory, Tenable Nessus).