CVE-2026-18329NGINX ngx_http_js_module vulnerability

Description

Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request that triggers an error condition in the access validation logic. This may cause the js_access phase to fail open, allowing the request to proceed instead of being denied, resulting in an authentication or authorization bypass and unauthorized access to protected resources. Impact This vulnerability may allow remote attackers to bypass js_access controls. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Timeline

Scores

EPSS (exploitation in 30 days)

0.65% · top 48% of all CVEs (14 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.

Affected products

• F5 · NGINX JavaScript

  • affected 1.0.0 – < 1.0.1
  • affected 0.9.9 – < *

What to do

Workaround: * To secure your NGINX njs js_access handler against unhandled exceptions such as JSON.parse failures, wrap your logic in a robust try/catch block with a default strict deny policy that returns an HTML 403 Forbidden response code. For example:async function auth(r) {   try {     // 1. Guard input: Safely check for the Authorization header     var authHeader = r.headersIn ? r.headersIn.Authorization : undefined;     if (!authHeader) {       r.warn("Access Denied: Missing Authorization header.");       return r.return(401);     }     // 2. Perform the async HTTP request     let reply = await ngx.fetch(' http://authsvc/check ', {       headers: { Authorization: authHeader }     });     // 3. Validate response status     if (reply.status !== 200) {       r.warn(`Access Denied: Auth service returned status ${reply.status}`);       return r.return(401);     }     // 4. Read response body     // Note: ngx.fetch body is read asynchronously using .text() or .json()     let responseText = await reply.text();     let payload = {};     // 5. Guard JSON.parse explicitly     try {       payload = JSON.parse(responseText);     } catch (jsonError) {       r.error(`Security Warning: Failed to parse auth service JSON payload: ${jsonError.message}`);       // Explicitly deny the request due to malformed auth response payload       return r.return(403);     }     // 6. Validate the contents of the parsed JSON     if (payload.authorized !== true) {       r.warn("Access Denied: Client token validated but not authorized.");       return r.return(403);     }     // 7. Success: Explicitly allow the request to proceed     return r.return(200);   } catch (globalError) {     // 8. Global Catch-All: Block the bypass vulnerability on any script exception     r.error(`Security Critical: Unhandled exception in auth handler: ${globalError.toString()}`);     // Always return 403 (Deny) on exception to guarantee a fail-closed state.     return r.return(403);   } } export default { auth }; * Place a security enforcement layer such as F5 WAF for NGINX or BIG-IP Advanced WAF before NGINX njs to prevent malformed requests. Configure the WAF to do the following: * Validate JSON syntax Enforce request body limits Block malformed payloads * Reject unexpected content types Apply API schema validation

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-70138 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-18329](https://cveledger.app/badge/CVE-2026-18329.svg)](https://cveledger.app/cve/CVE-2026-18329)

Record last updated 2 Sept 2026, 17:56 UTC.