Description
Description

NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request that triggers an error condition in the access validation logic. This may cause the js_access phase to fail open, allowing the request to proceed instead of being denied, resulting in an authentication or authorization bypass and unauthorized access to protected resources.

Impact

This vulnerability may allow remote attackers to bypass js_access controls. There is no control plane exposure; this is a data plane issue only.




Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Published: 2026-09-02
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

NGINX JavaScript (njs) and QuickJS (qjs) engines contain a flaw in the js_access phase where asynchronous request body processing can trigger an exception before an explicit access denial is returned. If the logic raises an error, the handler fails open, allowing the request to continue without authentication or authorization checks. This flaw is a typical input validation weakness (CWE‑636) that can result in an attacker bypassing authentication controls and gaining unauthorized access to protected resources.

Affected Systems

Products affected by this issue include the F5:NGINX JavaScript module (njs) and the QuickJS engine integrated into NGINX. The data plane component is implicated; however, the input does not specify vulnerable versions, so any deployment of the njs or qjs engine prior to an upstream fix could be at risk.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity, and although the EPSS score is not available, the lack of a KEV listing does not imply low risk. The vulnerability can be triggered remotely by crafting an HTTP request that causes an exception in asynchronous access‑control code. Because the flaw allows a graceful fail open, the attack is straightforward for an adversary on the network, potentially resulting in abuse of resources or data. Implementing the recommended try/catch logic or a WAF‑based guard lowers the likelihood of successful exploitation substantially.

Generated by OpenCVE AI on September 3, 2026 at 11:05 UTC.

Remediation

Vendor Workaround

* To secure your NGINX njs js_access handler against unhandled exceptions such as JSON.parse failures, wrap your logic in a robust try/catch block with a default strict deny policy that returns an HTML 403 Forbidden response code. For example:async function auth(r) {   try {     // 1. Guard input: Safely check for the Authorization header     var authHeader = r.headersIn ? r.headersIn.Authorization : undefined;     if (!authHeader) {       r.warn("Access Denied: Missing Authorization header.");       return r.return(401);     }     // 2. Perform the async HTTP request     let reply = await ngx.fetch(' http://authsvc/check ', {       headers: { Authorization: authHeader }     });     // 3. Validate response status     if (reply.status !== 200) {       r.warn(`Access Denied: Auth service returned status ${reply.status}`);       return r.return(401);     }     // 4. Read response body     // Note: ngx.fetch body is read asynchronously using .text() or .json()     let responseText = await reply.text();     let payload = {};     // 5. Guard JSON.parse explicitly     try {       payload = JSON.parse(responseText);     } catch (jsonError) {       r.error(`Security Warning: Failed to parse auth service JSON payload: ${jsonError.message}`);       // Explicitly deny the request due to malformed auth response payload       return r.return(403);     }     // 6. Validate the contents of the parsed JSON     if (payload.authorized !== true) {       r.warn("Access Denied: Client token validated but not authorized.");       return r.return(403);     }     // 7. Success: Explicitly allow the request to proceed     return r.return(200);   } catch (globalError) {     // 8. Global Catch-All: Block the bypass vulnerability on any script exception     r.error(`Security Critical: Unhandled exception in auth handler: ${globalError.toString()}`);     // Always return 403 (Deny) on exception to guarantee a fail-closed state.     return r.return(403);   } } export default { auth }; * Place a security enforcement layer such as F5 WAF for NGINX or BIG-IP Advanced WAF before NGINX njs to prevent malformed requests. Configure the WAF to do the following: * Validate JSON syntax Enforce request body limits Block malformed payloads * Reject unexpected content types Apply API schema validation

OpenCVE Recommended Actions

  • Wrap your njs js_access handler logic in a robust try/catch block and enforce a strict deny policy that returns a 403 Forbidden response on any unhandled exception.
  • Validate and parse all incoming data, including the Authorization header and JSON payload, with explicit checks and return 403 when parsing fails or the payload is malformed.
  • Deploy an external WAF layer, such as F5 WAF or BIG‑IP Advanced WAF, in front of NGINX and configure it to validate JSON syntax, enforce request body limits, reject unexpected content types, and apply API schema validation to block malformed requests.

Generated by OpenCVE AI on September 3, 2026 at 11:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 03 Sep 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared F5
F5 nginx Javascript
Vendors & Products F5
F5 nginx Javascript

Wed, 02 Sep 2026 10:45:00 +0000

Type Values Removed Values Added
Description Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request that triggers an error condition in the access validation logic. This may cause the js_access phase to fail open, allowing the request to proceed instead of being denied, resulting in an authentication or authorization bypass and unauthorized access to protected resources. Impact This vulnerability may allow remote attackers to bypass js_access controls. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Title NGINX ngx_http_js_module vulnerability
Weaknesses CWE-636
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}

cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

F5 Nginx Javascript
cve-icon MITRE

Status: PUBLISHED

Assigner: f5

Published:

Updated: 2026-09-02T17:56:59.397Z

Reserved: 2026-07-29T19:42:43.485Z

Link: CVE-2026-18329

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-02T16:17:14.917

Modified: 2026-09-03T16:37:52.170

Link: CVE-2026-18329

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T11:15:03Z

Weaknesses
  • CWE-636

    Not Failing Securely ('Failing Open')