Which versions of NGINX JavaScript are affected by EUVD-2026-70138?

NGINX JavaScript and QuickJS runtimes contain an access-control bypass vulnerability (CVSS 8.8) allowing unauthenticated attackers to reach protected backend resources when exceptions occur in async…. A patch is available.

How to fix or mitigate EUVD-2026-70138?

Within 24 hours, identify all NGINX instances using njs or QuickJS with js_access directives, specifically those implementing async request-body processing. Within 7 days, audit deployed access handlers for unprotected exception paths and implement interim mitigations including refactoring to synchronous patterns or adding explicit exception handling with default-deny fallback. Monitor NGINX and QuickJS upstream advisories for patch availability; once released, apply patch within 30 days and re-validate access-control enforcement through security testing.

NGINX JavaScript EUVD-2026-70138

Q: What is the CVSS score of EUVD-2026-70138?

EUVD-2026-70138 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-18329 HIGH

Not Failing Securely ('Failing Open') (CWE-636)

2026-09-02 f5

GHSA-jm9r-m8jm-j2hr

Authentication Bypass Nginx Suse Nginx Javascript F5

8.8

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Requires non-default async js_access handler without exception-safe denial (AC:H); no authentication needed (PR:N); confidentiality high from unauthorized resource access, integrity low from access-control bypass only.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Primary rating from Vendor (f5).

CVSS VectorVendor: f5

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Sep 02, 2026 - 17:02 EUVD

Analysis Generated

Sep 02, 2026 - 16:23 vuln.today

CVSS changed

Sep 02, 2026 - 16:22 NVD

8.2 (HIGH) 8.8 (HIGH)

CVE Published

Sep 02, 2026 - 15:40 cve.org

HIGH 8.8

DescriptionCVE.org

Description

NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request that triggers an error condition in the access validation logic. This may cause the js_access phase to fail open, allowing the request to proceed instead of being denied, resulting in an authentication or authorization bypass and unauthorized access to protected resources.

Impact

This vulnerability may allow remote attackers to bypass js_access controls. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Articles & Coverage 1

News 5 New Nginx Vulnerabilities - 1 Critical, 4 High Severity Sep 03, 2026

AnalysisAI

NGINX JavaScript (njs) and QuickJS (qjs) fail open during the js_access phase when an exception is thrown inside an asynchronous request-body processing handler before an explicit access-denial is returned. The flaw (CWE-636, Not Failing Securely) allows unauthenticated remote attackers to bypass js_access controls entirely and reach protected backend resources. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires the target NGINX instance to be configured with a js_access directive whose handler (1) performs asynchronous request-body reading (using async/await or callback-based body processing) and (2) lacks a try/catch block that explicitly issues an access denial on exception. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	F5's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N) scores 8.8 and reflects that no authentication or user interaction is required from the attacker. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Consult F5 advisory K000162599 (https://my.f5.com/manage/s/article/K000162599) for the specific patched njs version - an exact fix version is not independently confirmed from available metadata. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all NGINX instances using njs or QuickJS with js_access directives, specifically those implementing async request-body processing. …

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Nginx Javascript

View all

CVE-2026-78689 CRITICAL Act Now

9.2 Sep 02

Heap out-of-bounds write in NGINX JavaScript (njs) xml.exclusiveC14n() allows unauthenticated remote attackers to crash

CVE-2026-8711 CRITICAL Act Now

9.2 May 19

Heap buffer overflow in F5 NGINX JavaScript (njs) module versions 0.9.4 through 0.9.8 allows unauthenticated remote atta

CVE-2026-78222 HIGH This Week

8.7 Sep 02

NULL pointer dereference in NGINX JavaScript (njs) crashes NGINX worker processes when an njs script calls ngx.fetch() a

Same weakness CWE-636 – Not Failing Securely ('Failing Open')

View all

CVE-2026-22034 CRITICAL POC

9.8

CVE-2024-3729 CRITICAL

9.8

CVE-2026-53459 CRITICAL

9.3

CVE-2026-69306 HIGH

8.2

CVE-2026-81379 HIGH

8.2

CVE-2026-40525 CRITICAL

9.1

CVE-2024-43532 HIGH

8.8

CVE-2021-1578 HIGH

8.8

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

CVE-2023-46805 HIGH POC

8.2

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Module for Server Applications 15 SP7	Not-Affected
SUSE Linux Enterprise Server 15 SP7	Not-Affected
SUSE Linux Enterprise Server 16.0	Not-Affected
SUSE Linux Enterprise Server 16.1	Not-Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Not-Affected

EUVD-2026-70138 vulnerability details – vuln.today

Back

NGINX JavaScript EUVD-2026-70138

Severity by source

CVSS VectorVendor: f5

Lifecycle Timeline

DescriptionCVE.org

Articles & Coverage 1

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

More in Nginx Javascript

Same weakness CWE-636 – Not Failing Securely ('Failing Open')

Same technique Authentication Bypass

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code