CVE-2026-18329
HighCVSS 8.2Summary
A vulnerability in NGINX JavaScript (njs) and QuickJS (qjs) engines where an exception during asynchronous access-control evaluation can cause the js_access phase to fail open, allowing the request to proceed instead of being denied.
Risk Assessment
A remote attacker can bypass js_access controls, gaining unauthorized access to protected resources. This is a data plane issue only; no control plane exposure.
Recommendation
Update NGINX JavaScript and QuickJS to patched versions. Test js_access configurations for error scenarios.
Other vulnerabilities in NGINX JavaScript
See all- CVE-2026-78222High
A vulnerability in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response.
- CVE-2026-8711High
NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the ngx.fetch() operation from NGINX JavaScript. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Original NVD description (English source)
Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request that triggers an error condition in the access validation logic. This may cause the js_access phase to fail open, allowing the request to proceed instead of being denied, resulting in an authentication or authorization bypass and unauthorized access to protected resources. Impact This vulnerability may allow remote attackers to bypass js_access controls. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.