Skip to content
Advisories.
f5CVE-2026-78222

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText.

High8.7CVE-2026-78222 · Published Sep 2, 2026

Source advisory

Affected versions

PackageAffectedFixed in
NGINX JavaScript
Vendor
>= 0.5.1, < 1.0.11.0.1
Details and references

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity from
no source yet
Weakness
CWE-476

More f5 advisories

All
DateAdvisory
Sep 2Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and an exception is thrown during asynchronous...
CVE-2026-18329High8.8fixed in NGINX JavaScript 1.0.1
Sep 2A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages Impact: An attacker may trick authenticated BIG-IP users into accessing...
CVE-2026-63020Low2.3fixed in BIG-IP 21.1.0.1, BIG-IP 21.0.0.3, BIG-IP 17.5.1.8
Sep 2Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric.
CVE-2026-66362High8.6fixed in NGINX Gateway Fabric 2.6.8
Sep 2BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to Traffic Management User Interface (TMUI).
CVE-2026-66842High8.7fixed in BIG-IP 21.1.0.1, BIG-IP 21.0.0.3, BIG-IP 17.5.1.8
Sep 2When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller.
CVE-2026-77180High8.7fixed in NGINX Ingress Controller 5.6.0, NGINX Ingress Controller 2026-lts-r5
Sep 2Description NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n() method.
CVE-2026-78689Critical9.2fixed in NGINX JavaScript 1.0.1

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.