A malformed HTTP response received by the NGINX JavaScript (ngx_http_js_module) can cause the NGINX worker to crash when trusted JavaScript code accesses Response.statusText. The flaw does not provide code execution or data exfiltration; it merely results in a denial‑of‑service condition for the affected worker. The vulnerability requires the attacker to control or influence the fetched HTTP response, so it is a remote data‑plane issue only.

The flaw targets deployments of F5’s NGINX JavaScript module that use the ngx.fetch API and reference Response.statusText in trusted scripts. No specific product version information is supplied, so any configuration where the module is enabled and fetch responses are processed in user scripts could be impacted.

The CVSS score of 8.7 marks this as a high‑severity issue. Although the vulnerability is not listed in the CISA KEV catalog, the potential for DoS makes it a priority for mitigations. The likely attack vector is remote: an attacker who can provide a crafted HTTP response to a trusted fetch endpoint can trigger the crash by causing a malformed statusText value.