p PatchFirst

CVE-2026-78222

CVE-2026-78222 · NGINX ngx_http_js_module vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 8.7 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • nginx javascript

    Versions
    • ≥ 0.5.1, < 1.0.1: Affected (custom)

    Update to 1.0.1

  • libnginx-mod-js Debian:12

    Versions
    • 0.7.12-1
    • 0.7.12-2
    • 0.7.12-2~exp1
    • 0.7.12-2~exp2
    • 0.7.9-2
    • 0.8.0-1
    • 0.8.1-1
    • 0.8.2-1
    • 0.8.4-1
    • 0.8.5-1
    • 0.8.9-1
    • 0.9.1-1
    • 0.9.4-1
    • 0.9.6-1
    • 0.9.8-1
    • 0.9.9-1
    • 0.9.9-2
    • 1.0.0-1
    • 1.0.0-2
    • 1.0.0-3
    • 1.0.0-4
    • 1.0.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libnginx-mod-js Debian:13

    Versions
    • 0.8.9-1
    • 0.9.1-1
    • 0.9.4-1
    • 0.9.6-1
    • 0.9.8-1
    • 0.9.9-1
    • 0.9.9-2
    • 1.0.0-1
    • 1.0.0-2
    • 1.0.0-3
    • 1.0.0-4
    • 1.0.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libnginx-mod-js Debian:14

    Versions
    • 0.8.9-1
    • 0.9.1-1
    • 0.9.4-1
    • 0.9.6-1
    • 0.9.8-1
    • 0.9.9-1
    • 0.9.9-2
    • 1.0.0-1
    • 1.0.0-2
    • 1.0.0-3
    • 1.0.0-4
    Affected ranges
    • ECOSYSTEM: < 1.0.1-1

    Update to 1.0.1-1

  • libnginx-mod-js Ubuntu:24.04:LTS

    Versions
    • 0.7.12-2
    • 0.8.2-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libnginx-mod-js Ubuntu:26.10

    Versions
    • 0.9.4-1build2
    • 0.9.9-2
    • 1.0.0-1
    • 1.0.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libnginx-mod-js Ubuntu:Pro:26.04:LTS

    Versions
    • 0.9.1-1ubuntu2
    • 0.9.1-1ubuntu3
    • 0.9.4-1~build1
    • 0.9.4-1
    • 0.9.4-1build1
    • 0.9.4-1build2
    • 0.9.4-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →