NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request that triggers an error condition in the access validation logic. This may cause the js_access phase to fail open, allowing the request to proceed instead of being denied, resulting in an authentication or authorization bypass and unauthorized access to protected resources.
Impact
This vulnerability may allow remote attackers to bypass js_access controls. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| F5 | NGINX JavaScript | unknown |
|
No data.
No data.
No data available yet.
Vendor Workaround
* To secure your NGINX njs js_access handler against unhandled exceptions such as JSON.parse failures, wrap your logic in a robust try/catch block with a default strict deny policy that returns an HTML 403 Forbidden response code. For example:async function auth(r) { try { // 1. Guard input: Safely check for the Authorization header var authHeader = r.headersIn ? r.headersIn.Authorization : undefined; if (!authHeader) { r.warn("Access Denied: Missing Authorization header."); return r.return(401); } // 2. Perform the async HTTP request let reply = await ngx.fetch(' http://authsvc/check ', { headers: { Authorization: authHeader } }); // 3. Validate response status if (reply.status !== 200) { r.warn(`Access Denied: Auth service returned status ${reply.status}`); return r.return(401); } // 4. Read response body // Note: ngx.fetch body is read asynchronously using .text() or .json() let responseText = await reply.text(); let payload = {}; // 5. Guard JSON.parse explicitly try { payload = JSON.parse(responseText); } catch (jsonError) { r.error(`Security Warning: Failed to parse auth service JSON payload: ${jsonError.message}`); // Explicitly deny the request due to malformed auth response payload return r.return(403); } // 6. Validate the contents of the parsed JSON if (payload.authorized !== true) { r.warn("Access Denied: Client token validated but not authorized."); return r.return(403); } // 7. Success: Explicitly allow the request to proceed return r.return(200); } catch (globalError) { // 8. Global Catch-All: Block the bypass vulnerability on any script exception r.error(`Security Critical: Unhandled exception in auth handler: ${globalError.toString()}`); // Always return 403 (Deny) on exception to guarantee a fail-closed state. return r.return(403); } } export default { auth }; * Place a security enforcement layer such as F5 WAF for NGINX or BIG-IP Advanced WAF before NGINX njs to prevent malformed requests. Configure the WAF to do the following: * Validate JSON syntax Enforce request body limits Block malformed payloads * Reject unexpected content types Apply API schema validation
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://my.f5.com/manage/s/article/K000162599 |
|
Wed, 02 Sep 2026 10:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request that triggers an error condition in the access validation logic. This may cause the js_access phase to fail open, allowing the request to proceed instead of being denied, resulting in an authentication or authorization bypass and unauthorized access to protected resources. Impact This vulnerability may allow remote attackers to bypass js_access controls. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | |
| Title | NGINX ngx_http_js_module vulnerability | |
| Weaknesses | CWE-636 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: f5
Published:
Updated: 2026-09-02T17:56:59.397Z
Reserved: 2026-07-29T19:42:43.485Z
Link: CVE-2026-18329
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-02T16:17:14.917
Modified: 2026-09-02T18:19:16.033
Link: CVE-2026-18329
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-636
Not Failing Securely ('Failing Open')