NGINX ngx_http_js_module vulnerability
Summary
| CVE | CVE-2026-18329 |
|---|---|
| State | PUBLISHED |
| Assigner | f5 |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-02 16:17:14 UTC |
| Updated | 2026-09-03 16:37:52 UTC |
| Description | Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request that triggers an error condition in the access validation logic. This may cause the js_access phase to fail open, allowing the request to proceed instead of being denied, resulting in an authentication or authorization bypass and unauthorized access to protected resources. Impact This vulnerability may allow remote attackers to bypass js_access controls. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
Risk And Classification
Primary CVSS: v4.0 8.8 HIGH from [email protected]
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.003760000 probability, percentile 0.307690000 (date 2026-09-07)
Problem Types: CWE-636 | CWE-636 CWE-636
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 8.8 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 8.8 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N |
| 3.1 | [email protected] | Secondary | 8.2 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
| 3.1 | CNA | CVSS | 8.2 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | F5 | NGINX JavaScript | affected 1.0.0 1.0.1 custom | Not specified |
| CNA | F5 | NGINX JavaScript | affected 0.9.9 * custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| my.f5.com/manage/s/article/K000162599 | [email protected] | my.f5.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: F5 acknowledges Ta Duc Thien (@thientd) of NTCS for bringing this issue to our attention and following the highest standards of coordinated disclosure. (en)
Additional Advisory Data
Workarounds
CNA: * To secure your NGINX njs js_access handler against unhandled exceptions such as JSON.parse failures, wrap your logic in a robust try/catch block with a default strict deny policy that returns an HTML 403 Forbidden response code. For example:async function auth(r) { try { // 1. Guard input: Safely check for the Authorization header var authHeader = r.headersIn ? r.headersIn.Authorization : undefined; if (!authHeader) { r.warn("Access Denied: Missing Authorization header."); return r.return(401); } // 2. Perform the async HTTP request let reply = await ngx.fetch(' http://authsvc/check ', { headers: { Authorization: authHeader } }); // 3. Validate response status if (reply.status !== 200) { r.warn(`Access Denied: Auth service returned status ${reply.status}`); return r.return(401); } // 4. Read response body // Note: ngx.fetch body is read asynchronously using .text() or .json() let responseText = await reply.text(); let payload = {}; // 5. Guard JSON.parse explicitly try { payload = JSON.parse(responseText); } catch (jsonError) { r.error(`Security Warning: Failed to parse auth service JSON payload: ${jsonError.message}`); // Explicitly deny the request due to malformed auth response payload return r.return(403); } // 6. Validate the contents of the parsed JSON if (payload.authorized !== true) { r.warn("Access Denied: Client token validated but not authorized."); return r.return(403); } // 7. Success: Explicitly allow the request to proceed return r.return(200); } catch (globalError) { // 8. Global Catch-All: Block the bypass vulnerability on any script exception r.error(`Security Critical: Unhandled exception in auth handler: ${globalError.toString()}`); // Always return 403 (Deny) on exception to guarantee a fail-closed state. return r.return(403); } } export default { auth }; * Place a security enforcement layer such as F5 WAF for NGINX or BIG-IP Advanced WAF before NGINX njs to prevent malformed requests. Configure the WAF to do the following: * Validate JSON syntax Enforce request body limits Block malformed payloads * Reject unexpected content types Apply API schema validation