NGINX JavaScript CVE-2026-101025

Requires an NGINX deployment where the optional njs (NGINX JavaScript) module is loaded AND the configured JavaScript logic calls xml.parse() on attacker-supplied XML in the data plane; absent that specific feature usage the leak is unreachable. The leak is triggered specifically by the xml.parse() failure path on malformed XML, so parsing of only well-formed, trusted XML is not affected. No authentication is required (CVSS PR:N) and exploitation is remote and unauthenticated, but impact accrues gradually across many requests against long-lived worker processes rather than from a single request, and the control plane is explicitly not exposed - this is a data-plane-only issue.

This is a moderate-severity denial-of-service issue, not a high-priority emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, low-complexity, unauthenticated vector, but the only impact is availability (VA:L) with no confidentiality or integrity effect, consistent with CWE-401 memory leak semantics - a gradual resource-exhaustion condition rather than direct code execution or crash-on-first-request. No EPSS score, CISA KEV listing, SSVC decision data, or POC is present in the provided intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk profile rests entirely on theoretical reachability. The score-limiting factor is reachability: the impact only materializes where the optional njs module is loaded AND application logic calls xml.parse() on attacker-controlled XML, which is a specific deployment pattern rather than a default NGINX install. Net: treat as a routine patch-when-convenient DoS fix for environments actually running njs XML parsing on untrusted input, not a drop-everything issue. One caveat to verify with F5: the advisory notes End-of-Technical-Support versions are not evaluated, so affected-version coverage for older releases is explicitly incomplete.

An attacker repeatedly sends HTTP requests carrying malformed XML bodies to an NGINX endpoint whose njs configuration invokes xml.parse() on that input. Because the failed-parse path never releases the libxml2 parser context, each request leaks memory in the long-lived worker process, and sustained traffic drives unbounded memory growth until the worker is terminated or the host degrades. No authentication or user interaction is required (PR:N/UI:N), but no public proof-of-concept is identified in the provided data.