Nginx Javascript
Monthly
Canonicalization inconsistency in the NGINX JavaScript (njs) XML module lets an unauthenticated attacker who already holds a genuinely signed SAML/XML document cause entity-backed attributes to appear absent or truncated ($attr$Name returning undefined, $attrs derived from only the first attribute child) while signature verification still succeeds. nginx-saml running the built-in njs backend is the confirmed affected consumer, where this can bypass expiry, Destination, and request-correlation checks and enable replay or acceptance of a response outside its intended context; the flaw cannot forge signatures or identities and has no availability or control-plane impact. F5's advisory rates this 8.3 (High, CVSS 4.0 with AT:P reflecting the significant effort needed to obtain a validly signed document); no public exploit code was identified at time of analysis, and no KEV listing applies. There is no public exploit identified at time of analysis.
NULL pointer dereference in NGINX JavaScript (njs) crashes NGINX worker processes when an njs script calls ngx.fetch() against a server that returns a malformed HTTP response and subsequently reads Response.statusText on the result. All versions of F5's NGINX JavaScript module are listed as affected per the wildcard CPE, and the impact is confined entirely to the data plane - worker availability - with no control-plane, confidentiality, or integrity exposure. No public exploit code exists and the CVE is not listed in CISA KEV at time of analysis, but the network-accessible path and zero-privilege requirement make this a credible service-disruption risk for any NGINX deployment using njs-based outbound HTTP fetching.
Heap out-of-bounds write in NGINX JavaScript (njs) xml.exclusiveC14n() allows unauthenticated remote attackers to crash NGINX worker processes or cause unbounded memory growth, with theoretical code execution that has not been demonstrated. The vulnerability is directly reachable in the nginxinc/nginx-saml reference SAML SP implementation, which passes untrusted InclusiveNamespaces/@PrefixList values to xml.exclusiveC14n() before signature verification completes - meaning no valid SAML signature is required to trigger it. Both the njs (default) and QuickJS engines are affected, with differing crash-vs-leak behavior, but both result in denial of service. No public exploit is identified at time of analysis.
NGINX JavaScript (njs) and QuickJS (qjs) fail open during the js_access phase when an exception is thrown inside an asynchronous request-body processing handler before an explicit access-denial is returned. The flaw (CWE-636, Not Failing Securely) allows unauthenticated remote attackers to bypass js_access controls entirely and reach protected backend resources. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation is bounded by the requirement for a specific async access-handler pattern.
Heap buffer overflow in F5 NGINX JavaScript (njs) module versions 0.9.4 through 0.9.8 allows unauthenticated remote attackers to crash NGINX worker processes, with potential remote code execution on hosts where ASLR is disabled. Exploitation requires the deployment to use the js_fetch_proxy directive with at least one client-controlled NGINX variable (such as $http_*, $arg_*, or $cookie_*) and a location that invokes ngx.fetch(). No public exploit identified at time of analysis, but a vendor patch is available and the CVSS 4.0 base score of 9.2 reflects the high impact across confidentiality, integrity, and availability.
Malformed XML parsed through NGINX JavaScript (njs) xml.parse() leaks libxml2 parser contexts, allowing unauthenticated remote requests to cause gradual, unbounded memory growth in long-lived NGINX worker processes and potentially leading to worker termination or denial of service. This is a moderate-severity data-plane issue and is exploitable only in deployments where the optional njs module is loaded and configured JavaScript logic calls xml.parse() on attacker-supplied XML; no public exploit identified at time of analysis. The independent assessment confirms remote unauthenticated reachability with low availability impact, and explicitly notes that the control plane is not exposed.
Canonicalization inconsistency in the NGINX JavaScript (njs) XML module lets an unauthenticated attacker who already holds a genuinely signed SAML/XML document cause entity-backed attributes to appear absent or truncated ($attr$Name returning undefined, $attrs derived from only the first attribute child) while signature verification still succeeds. nginx-saml running the built-in njs backend is the confirmed affected consumer, where this can bypass expiry, Destination, and request-correlation checks and enable replay or acceptance of a response outside its intended context; the flaw cannot forge signatures or identities and has no availability or control-plane impact. F5's advisory rates this 8.3 (High, CVSS 4.0 with AT:P reflecting the significant effort needed to obtain a validly signed document); no public exploit code was identified at time of analysis, and no KEV listing applies. There is no public exploit identified at time of analysis.
NULL pointer dereference in NGINX JavaScript (njs) crashes NGINX worker processes when an njs script calls ngx.fetch() against a server that returns a malformed HTTP response and subsequently reads Response.statusText on the result. All versions of F5's NGINX JavaScript module are listed as affected per the wildcard CPE, and the impact is confined entirely to the data plane - worker availability - with no control-plane, confidentiality, or integrity exposure. No public exploit code exists and the CVE is not listed in CISA KEV at time of analysis, but the network-accessible path and zero-privilege requirement make this a credible service-disruption risk for any NGINX deployment using njs-based outbound HTTP fetching.
Heap out-of-bounds write in NGINX JavaScript (njs) xml.exclusiveC14n() allows unauthenticated remote attackers to crash NGINX worker processes or cause unbounded memory growth, with theoretical code execution that has not been demonstrated. The vulnerability is directly reachable in the nginxinc/nginx-saml reference SAML SP implementation, which passes untrusted InclusiveNamespaces/@PrefixList values to xml.exclusiveC14n() before signature verification completes - meaning no valid SAML signature is required to trigger it. Both the njs (default) and QuickJS engines are affected, with differing crash-vs-leak behavior, but both result in denial of service. No public exploit is identified at time of analysis.
NGINX JavaScript (njs) and QuickJS (qjs) fail open during the js_access phase when an exception is thrown inside an asynchronous request-body processing handler before an explicit access-denial is returned. The flaw (CWE-636, Not Failing Securely) allows unauthenticated remote attackers to bypass js_access controls entirely and reach protected backend resources. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation is bounded by the requirement for a specific async access-handler pattern.
Heap buffer overflow in F5 NGINX JavaScript (njs) module versions 0.9.4 through 0.9.8 allows unauthenticated remote attackers to crash NGINX worker processes, with potential remote code execution on hosts where ASLR is disabled. Exploitation requires the deployment to use the js_fetch_proxy directive with at least one client-controlled NGINX variable (such as $http_*, $arg_*, or $cookie_*) and a location that invokes ngx.fetch(). No public exploit identified at time of analysis, but a vendor patch is available and the CVSS 4.0 base score of 9.2 reflects the high impact across confidentiality, integrity, and availability.
Malformed XML parsed through NGINX JavaScript (njs) xml.parse() leaks libxml2 parser contexts, allowing unauthenticated remote requests to cause gradual, unbounded memory growth in long-lived NGINX worker processes and potentially leading to worker termination or denial of service. This is a moderate-severity data-plane issue and is exploitable only in deployments where the optional njs module is loaded and configured JavaScript logic calls xml.parse() on attacker-supplied XML; no public exploit identified at time of analysis. The independent assessment confirms remote unauthenticated reachability with low availability impact, and explicitly notes that the control plane is not exposed.