Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: F5 NGINX JavaScript 1.0.1 Clear all filters
TI-2026-54403 CVE-2026-78222 · GHSA-27f9-cgjj-wvcv

NGINX ngx_http_js_module vulnerability

Priority MEDIUM 45

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00623 Published 2026-09-02 Fixed in 1.0.1 CWE-476
TI-2026-54698 CVE-2026-78689 · GHSA-3gxx-pmrm-ghvv

NGINX ngx_http_js_module vulnerablility

Priority MEDIUM 43

Description NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n() method.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.0076 Published 2026-09-02 Fixed in 1.0.1 CWE-122
TI-2026-15076 CVE-2026-18329 · GHSA-jm9r-m8jm-j2hr

NGINX ngx_http_js_module vulnerability

Priority MEDIUM 45

Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evalu…

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00645 Published 2026-09-02 Fixed in 1.0.1 CWE-636