Skip to content
fr Sign in
7.5 High

CVE-2026-78222 A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX…

Description

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products and versions

Product Affected versions Fixed in
NGINX JavaScript 0.5 0.5.1 → < 1.0.1 1.0.1

References

Timeline

  1. Published
  2. Last modified

Other CVEs of NGINX JavaScript

The 6 CVEs of NGINX JavaScript →
CVE-2026-101025 Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when… 5.3 Medium CVE-2026-101019 Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes… 6.5 Medium CVE-2026-78689 Description NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list parser, reachable… 8.1 High CVE-2026-18329 Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs… 8.2 High
Track this CVE