Nginx Javascript (F5) - vulnerabilities (CVEs)

6 CVEs, 2 in the last 30 days, 2 known versions, newest CVE from 2026-10-14. Vendor: F5.

CVEs of Nginx Javascript

• CVE-2026-101025 - CVSS 6.9 (medium), 2026-10-14: Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path…
• CVE-2026-101019 - CVSS 8.3 (high), 2026-10-14: Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2…
• CVE-2026-78689 - CVSS 9.2 (critical), 2026-09-02: Description NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n() method. An…
• CVE-2026-78222 - CVSS 8.7 (high), 2026-09-02: A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads…
• CVE-2026-18329 - CVSS 8.8 (high), 2026-09-02: Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and…
• CVE-2026-8711 - CVSS 9.8 (critical), 2026-05-19: NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*,…