CVE-2026-78222 PUBLISHED

NGINX ngx_http_js_module vulnerability

Assigner: f5
Reserved: 25.08.2026 Published: 02.09.2026 Updated: 02.09.2026

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response.

Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS Score: 8.7

Product Status

Vendor F5
Product NGINX JavaScript
Versions Default: unknown
  • affected from 0.5.1 to 1.0.1 (excl.)

Workarounds

Restrict ngx.fetch() destinations to trusted servers and avoid reading Response.statusText for responses from attacker-controlled or attacker-influenced endpoints. Using HTTPS with certificate verification reduces exposure to network-based response manipulation but does not protect against a malicious or compromised fetched server

Credits

  • F5 acknowledges Sujal Tuladhar (EvilGenius) and YuuLuo for bringing this issue to our attention and following the highest standards of coordinated disclosure. reporter

References

Problem Types

  • CWE-476 NULL Pointer Dereference CWE