The vulnerability arises when the NGINX JavaScript (njs) library fails to clean up a libxml2 parser context after a malformed XML parsing error. The leaked context remains allocated for the lifetime of a worker process, causing unbounded memory growth. This can lead to worker termination or a denial of service for requests that repeatedly trigger the parse error. The weakness is an uncontrolled memory allocation flaw (CWE‑401).

The affected product is the NGINX JavaScript (njs) module distributed as part of F5 NGINX. No specific version information is provided in the CVE data, and confirmed support status is not indicated. The vulnerability is present in all current releases that include the vulnerable parsing routine in the njs engine.

The CVSS score of 6.9 indicates moderate to high severity. The EPSS score of <1% indicates a low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited or no public exploitation yet. The likely attack vector is remote, where an unauthenticated attacker sends crafted XML payloads to the data plane; the flaw does not require privileged access or control plane interaction. Because the flaw manifests only when parsing fails, repeated detection of malformed XML can be used to exhaust memory and eventually cause service disruption.