F5 Nginx Javascript vulnerabilities

CVE-2026-8711 [CRITICAL] CWE-122 CVE-2026-8711: NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least o NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the ngx.fetch() operation from NGINX JavaScript. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests. This ma

CVE-2026-18329 [HIGH] CWE-636 CVE-2026-18329: Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker can exploit this vulnerability by sending a crafted HT

CVE-2026-78689 [HIGH] CWE-122 CVE-2026-78689: Description NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list p Description NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n() method. An unauthenticated remote attacker can trigger it when an affected NGINX configuration passes an externally controlled XML namespace prefix list to that method. Both the njs and the QuickJS (qjs) en

CVE-2026-78222 [HIGH] CWE-476 CVE-2026-78222: A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() c A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX

CVE-2026-101019 [MEDIUM] CWE-436 CVE-2026-101019: Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backe Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an explicitly present attribute containing an internal e

CVE-2026-101025 [MEDIUM] CWE-401 CVE-2026-101025: Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxm Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests with malformed XML and can cause unbounded memory growt