CVE-2026-101025
MediumCVSS 5.3Summary
NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests with malformed XML and can cause unbounded memory growth in long-lived NGINX worker processes.
Risk Assessment
An attacker can remotely send requests that trigger repeated parsing of malformed XML and may lead to NGINX worker termination or denial of service (DoS). There is no control plane exposure; this is a data plane issue only.
Recommendation
Update NGINX JavaScript (njs) to a version containing the fix. If updating is not possible, consider restricting processing of malformed XML or monitoring worker process memory usage.
Other vulnerabilities in NGINX JavaScript (njs)
See all- CVE-2026-101019Medium
The njs XML module in NGINX JavaScript (njs) exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends, the $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference, and the $attrs getter may return a value derived only from the first attribute child. This may allow an unauthenticated attacker to skip validation while signature verification succeeds.
- CVE-2026-78689High
A vulnerability in the XML module of NGINX JavaScript (njs) affects the namespace prefix list parser, reachable through the xml.exclusiveC14n() method. An unauthenticated remote attacker can trigger an out-of-bounds write past the end of a heap allocation when an affected NGINX configuration passes an externally controlled XML namespace prefix list to that method. Both the njs and QuickJS (qjs) engines are affected.
Original NVD description (English source)
Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests with malformed XML and can cause unbounded memory growth in long-lived NGINX worker processes. Impact This vulnerability may allow remote attackers to send requests that trigger repeated parsing of malformed XML and may lead to NGINX worker termination or denial of service. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS