Read the docs
TI-2026-74066 Aliases CVE-2026-101025GHSA-4jj4-r79f-9v3x

NGINX JavaScript (njs) memory leak in xml.parse() failure path

Priority LOW 36CWE-401Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-401.

Summary

F5 NGINX JavaScript (njs) from 0.7.10 before 1.0.2 leaks a libxml2 parser context when xml.parse() fails, because the failure path does not register cleanup. An unauthenticated remote attacker can send requests with malformed XML, causing unbounded memory growth in long-lived NGINX worker processes and possibly worker termination. The flaw is classified as CWE-401, Missing Release of Memory after Effective Lifetime.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests with malformed XML and can cause unbounded memory growth in long-lived NGINX worker processes. Impact This vulnerability may allow remote attackers to send requests that trigger repeated parsing of malformed XML and may lead to NGINX worker termination or denial of service. There is no control plane exposure; this is a data plane issue only.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00316 24th percentileScored 2026-11-07
Fix Fixed NGINX JavaScript (F5): 1.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
F5NGINX JavaScript0.7.10 to before 1.0.21.0.2Patch availableCNA
  • NGINX JavaScript VendorF5 Affected 0.7.10 to before 1.0.2 Fixed in 1.0.2 Patch available CNA

Remediation

Upgrade NGINX JavaScript (njs) to version 1.0.2 or later, which fixes the issue for affected versions from 0.7.10 before 1.0.2.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA NGINX JavaScript (F5) Fixed in 1.0.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    F5 NGINX JavaScript 1.0.2

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-74065 Interpretation conflict in NGINX JavaScript XML attribute handlingPriority LOW 35
    Show all 2 records →

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-101025
  2. 2026-10-14 Alias added: GHSA-4jj4-r79f-9v3x
  3. 2026-10-16 CISA SSVC decision points changed
  4. 2026-10-16 Priority changed: MEDIUM → LOW

References

Advisory 1

  • TI-2023-25230 BIG-IP Configuration utility unauthenticated remote code execution vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-01269 Missing authentication in F5 BIG-IP KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05850 Memory corruption in BIG-IP KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05845 Server-side request forgery in BIG-IP; BIG-IQ KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-04820 Path traversal in BIG-IP KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
See all 1057 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences