112 matches found
CVE-2026-78689
Description NGINX JavaScript njs has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n method. An unauthenticated remote attacker can trigger it when an affected NGINX configuration passes an externally controlled XML namespace prefix list t...
CVE-2026-18329
Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...
CVE-2026-78689 NGINX ngx_http_js_module vulnerablility
Description NGINX JavaScript njs has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n method. An unauthenticated remote attacker can trigger it when an affected NGINX configuration passes an externally controlled XML namespace prefix list t...
CVE-2026-78689
NGINX JavaScript (njs) contains a heap-based buffer overflow (CWE-122) in the XML module's namespace prefix list parser, reachable via the xml.exclusiveC14n() method. Both the njs and QuickJS (qjs) engines are affected. With njs, the out-of-bounds write corrupts adjacent objects and crashes the N...
CVE-2026-18329 NGINX ngx_http_js_module vulnerability
Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...
EUVD-2026-70138
Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...
K000162602: NGINX ngx_http_js_module vulnerability CVE-2026-78689
Security Advisory Description NGINX JavaScript njs has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n method. An unauthenticated remote attacker can trigger it when an affected NGINX configuration passes an externally controlled XML...
CVE-2022-31306
Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njsarrayconverttoslowarray at src/njsarray.c...
CVE-2022-31307
Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njsstringoffset at src/njsstring.c...
CVE-2022-35173
An issue was discovered in Nginx NJS v0.7.5. The JUMP offset for a break instruction was not set to a correct offset during code generation, leading to a segmentation violation...
CVE-2019-11838
njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in Array.prototype.splice after a resize, related to njsarrayprototypesplice in njs/njsarray.c, because of njsarrayexpand size mishandling...
CVE-2022-27007
nginx njs 0.7.2 is affected suffers from Use-after-free in njsfunctionframealloc when it try to invoke from a restored frame saved with njsfunctionframesave...
EUVD-2019-5052
Malware in sbrugna...
EUVD-2020-11597
Malware in sbrugna...
EUVD-2019-3502
Malware in sbrugna...
EUVD-2023-31466
Malicious code in bioql PyPI...
EUVD-2022-31548
Malicious code in bioql PyPI...
EUVD-2022-32535
Malicious code in bioql PyPI...