CVE-2026-78222
HighCVSS 7.5Summary
A vulnerability in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response.
Risk Assessment
A remote attacker can cause a denial-of-service (DoS) on the NGINX system. This is a data plane issue only; no control plane exposure.
Recommendation
Update NGINX JavaScript to a patched version. Restrict trusted sources of HTTP responses used by ngx.fetch().
Other vulnerabilities in NGINX JavaScript
See all- CVE-2026-18329High
A vulnerability in NGINX JavaScript (njs) and QuickJS (qjs) engines where an exception during asynchronous access-control evaluation can cause the js_access phase to fail open, allowing the request to proceed instead of being denied.
- CVE-2026-8711High
NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the ngx.fetch() operation from NGINX JavaScript. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Original NVD description (English source)
A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.