Skip to main content

NGINX JavaScript CVE-2026-78222

| EUVDEUVD-2026-70144 HIGH
NULL Pointer Dereference (CWE-476)
2026-09-02 f5 GHSA-27f9-cgjj-wvcv
Denial Of Service Null Pointer Dereference Nginx Suse Nginx Javascript F5
8.7
CVSS 4.0 · Vendor: f5
Share

Severity by source

Vendor (f5) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network vector (malformed response arrives over the network); no NGINX-side authentication required; scope unchanged (worker crash is self-contained); only availability impact, no data exposure.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (f5).

CVSS VectorVendor: f5

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

6
Patch available
Sep 02, 2026 - 17:02 EUVD
Analysis Updated
Sep 02, 2026 - 16:29 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Sep 02, 2026 - 16:22 vuln.today
cvss_changed
CVSS changed
Sep 02, 2026 - 16:22 NVD
7.5 (HIGH) 8.7 (HIGH)
Analysis Generated
Sep 02, 2026 - 16:21 vuln.today
CVE Published
Sep 02, 2026 - 15:40 cve.org
HIGH 7.5

DescriptionCVE.org

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response.

Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Articles & Coverage 1

News 5 New Nginx Vulnerabilities - 1 Critical, 4 High Severity Sep 03, 2026

AnalysisAI

NULL pointer dereference in NGINX JavaScript (njs) crashes NGINX worker processes when an njs script calls ngx.fetch() against a server that returns a malformed HTTP response and subsequently reads Response.statusText on the result. All versions of F5's NGINX JavaScript module are listed as affected per the wildcard CPE, and the impact is confined entirely to the data plane - worker availability - with no control-plane, confidentiality, or integrity exposure. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Two conditions must be simultaneously satisfied: (1) the NGINX instance must be running at least one active njs script that calls ngx.fetch() and subsequently reads Response.statusText on the response object, and (2) the attacker must be able to control or influence the HTTP response returned by the upstream server contacted by that fetch - either by directly operating the server NGINX is configured to query, compromising that server, or occupying a network-level MITM position between NGINX and the upstream. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.7 reflects a network-accessible, unauthenticated path to high availability impact with no confidentiality or integrity loss, which is consistent with the worker-crash impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Consult and apply the fix described in F5 advisory K000162603 at https://my.f5.com/manage/s/article/K000162603; no specific patched version number was available in the provided data, so the advisory must be checked directly for the minimum safe release. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Identify all NGINX deployments using the njs module with ngx.fetch() for outbound HTTP connections and establish monitoring for unexpected worker crashes. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Nginx Javascript

View all
CVE-2026-78689 CRITICAL
9.2 Sep 02

Heap out-of-bounds write in NGINX JavaScript (njs) xml.exclusiveC14n() allows unauthenticated remote attackers to crash

CVE-2026-8711 CRITICAL
9.2 May 19

Heap buffer overflow in F5 NGINX JavaScript (njs) module versions 0.9.4 through 0.9.8 allows unauthenticated remote atta
CVE-2026-18329 HIGH
8.8 Sep 02

NGINX JavaScript (njs) and QuickJS (qjs) fail open during the js_access phase when an exception is thrown inside an asyn

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Module for Server Applications 15 SP7 Not-Affected
SUSE Linux Enterprise Server 15 SP7 Not-Affected
SUSE Linux Enterprise Server 16.0 Not-Affected
SUSE Linux Enterprise Server 16.1 Not-Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Not-Affected

Share

CVE-2026-78222 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy