EUVD-2026-70138
GHSA-jm9r-m8jm-j2hr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires non-default async js_access handler without exception-safe denial (AC:H); no authentication needed (PR:N); confidentiality high from unauthorized resource access, integrity low from access-control bypass only.
Primary rating from Vendor (f5).
CVSS VectorVendor: f5
Lifecycle Timeline
4DescriptionCVE.org
Description
NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request that triggers an error condition in the access validation logic. This may cause the js_access phase to fail open, allowing the request to proceed instead of being denied, resulting in an authentication or authorization bypass and unauthorized access to protected resources.
Impact
This vulnerability may allow remote attackers to bypass js_access controls. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Articles & Coverage 1
AnalysisAI
NGINX JavaScript (njs) and QuickJS (qjs) fail open during the js_access phase when an exception is thrown inside an asynchronous request-body processing handler before an explicit access-denial is returned. The flaw (CWE-636, Not Failing Securely) allows unauthenticated remote attackers to bypass js_access controls entirely and reach protected backend resources. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target NGINX instance to be configured with a js_access directive whose handler (1) performs asynchronous request-body reading (using async/await or callback-based body processing) and (2) lacks a try/catch block that explicitly issues an access denial on exception. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | F5's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N) scores 8.8 and reflects that no authentication or user interaction is required from the attacker. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult F5 advisory K000162599 (https://my.f5.com/manage/s/article/K000162599) for the specific patched njs version - an exact fix version is not independently confirmed from available metadata. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all NGINX instances using njs or QuickJS with js_access directives, specifically those implementing async request-body processing. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Nginx Javascript
View allHeap buffer overflow in F5 NGINX JavaScript (njs) module versions 0.9.4 through 0.9.8 allows unauthenticated remote atta
Heap out-of-bounds write in NGINX JavaScript (njs) xml.exclusiveC14n() allows unauthenticated remote attackers to crash
NULL pointer dereference in NGINX JavaScript (njs) crashes NGINX worker processes when an njs script calls ngx.fetch() a
Same weakness CWE-636 – Not Failing Securely ('Failing Open')
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today