NGINX JavaScript (njs) vulnerabilities

NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests with malformed XML and can cause unbounded memory growth in long-lived NGINX worker processes.

The njs XML module in NGINX JavaScript (njs) exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends, the $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference, and the $attrs getter may return a value derived only from the first attribute child. This may allow an unauthenticated attacker to skip validation while signature verification succeeds.

A vulnerability in the XML module of NGINX JavaScript (njs) affects the namespace prefix list parser, reachable through the xml.exclusiveC14n() method. An unauthenticated remote attacker can trigger an out-of-bounds write past the end of a heap allocation when an affected NGINX configuration passes an externally controlled XML namespace prefix list to that method. Both the njs and QuickJS (qjs) engines are affected.