Aller au contenu
en Se connecter
7.5 Élevée

CVE-2026-78222 A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX…

Description

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Produits et versions touchés

Produit Versions touchées Corrigé en
NGINX JavaScript 0.5 0.5.1 → < 1.0.1 1.0.1

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de NGINX JavaScript

Les 6 CVE de NGINX JavaScript →
CVE-2026-101025 Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when… 5.3 Moyenne CVE-2026-101019 Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes… 6.5 Moyenne CVE-2026-78689 Description NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list parser, reachable… 8.1 Élevée CVE-2026-18329 Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs… 8.2 Élevée
Suivre cette CVE