p PatchFirst

PatchFirst · Latest vulnerabilities

libnginx-mod-js vulnerabilities

Vulnerabilities published for libnginx-mod-js in the last 30 days: 2. Listed in the KEV catalogue: 0.

RSS ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 6

  1. CVE-2026-101019

    High · CVSS 8.3EPSS 0.2%Fix available

    NGINX ngx_http_js_module vulnerability

    Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference. The $attrs getter may return a value derived only from the first attribute child. This may allow an unauthenticated attacker that invests significant effort in obtaining a genuinely signed document to skip validation while signature verification succeeds. An nginx-saml deployment is

    libnginx-mod-jsOperating systems
    • Update to 1.0.2-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  2. CVE-2026-101025

    Medium · CVSS 6.9EPSS 0.32%Fix available

    NGINX ngx_http_js_module vulnerability

    Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests with malformed XML and can cause unbounded memory growth in long-lived NGINX worker processes. Impact This vulnerability may allow remote attackers to send requests that trigger repeated parsing of malformed XML and may lead to NGINX worker termination or denial of service. There is no control plane exposure; this is a data plane issue only.  Not

    libnginx-mod-jsOperating systems
    • Update to 1.0.2-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  3. CVE-2026-78222

    High · CVSS 8.7EPSS 0.62%Fix available

    NGINX ngx_http_js_module vulnerability

    A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    libnginx-mod-jsOperating systems
    • Update to 1.0.1-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  4. CVE-2026-78689

    Critical · CVSS 9.2EPSS 0.76%Fix available

    NGINX ngx_http_js_module vulnerablility

    Description NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n() method. An unauthenticated remote attacker can trigger it when an affected NGINX configuration passes an externally controlled XML namespace prefix list to that method. Both the njs and the QuickJS (qjs) engines are affected. A crafted prefix list causes an out-of-bounds write past the end of a heap allocation. With the njs engine, which is the engine used when the js_engine directive is absent, this corrupts adjacent objects and crashes the NGINX worker. With the QuickJS engine, the same call ad

    libnginx-mod-jsOperating systems
    • Update to 1.0.1-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  5. CVE-2026-18329

    High · CVSS 8.8EPSS 0.38%Fix available

    NGINX ngx_http_js_module vulnerability

    Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request that triggers an error condition in the access validation logic. This may cause the js_access phase to fail open, allowing the request to proceed instead of being denied, resulting in an authentication or authorization bypass and unauthorized access to protected resources. Impact T

    libnginx-mod-jsOperating systems
    • Update to 1.0.1-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  6. CVE-2026-8711

    Critical · CVSS 9.2EPSS 0.79%Fix available

    NGINX JavaScript vulnerability

    NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the ngx.fetch() operation from NGINX JavaScript. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (

    libnginx-mod-jsOperating systems
    • Update to 0.9.9-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →