NGINX buffer overflow vulnerability

Nginx is a lightweight web server/reverse proxy server and email IMAP/POP3 proxy server from Nginx, Inc. A buffer overflow vulnerability exists in njsvmcodetypeof in /src/njsvmcode.c in njs 0.7.0 and earlier versions. out-of-bounds array access. No detailed vulnerability details are currently...

PT-2022-2375 · Nginx · Nginx Njs

Name of the Vulnerable Software and Affected Versions: nginx njs version 0.7.2 Description: The issue is related to a Buffer Overflow in the Array.prototype.concat function of the njs interpreter in the nginx server. This occurs when a slow array appended element is a fast array, leading to a typ...

PT-2022-2376 · Nginx · Nginx Njs

Name of the Vulnerable Software and Affected Versions: nginx njs version 0.7.2 Description: The issue is related to a Use-after-free in the njs function frame alloc function when it tries to invoke from a restored frame saved with njs function frame save. This can allow a remote attacker to impac...

CVE-2022-25139

njs through 0.7.0, used in NGINX, was discovered to contain a heap use-after-free in njsawaitfulfilled...

CVE-2022-25139

njs through 0.7.0, used in NGINX, was discovered to contain a heap use-after-free in njsawaitfulfilled...

ALPINE-CVE-2022-25139

njs through 0.7.0, used in NGINX, was discovered to contain a heap use-after-free in njsawaitfulfilled...

CVE-2021-46462

njs through 0.7.1, used in NGINX, was discovered to contain a segmentation violation via njsobjectsetprototype in /src/njsobject.c...

CVE-2021-46463

njs through 0.7.1, used in NGINX, was discovered to contain a control flow hijack caused by a Type Confusion vulnerability in njspromiseperformthen...

CVE-2021-46461

njs through 0.7.0, used in NGINX, was discovered to contain an out-of-bounds array access via njsvmcodetypeof in /src/njsvmcode.c...

CVE-2021-46461

njs through 0.7.0, used in NGINX, was discovered to contain an out-of-bounds array access via njsvmcodetypeof in /src/njsvmcode.c...

CVE-2021-46463

njs through 0.7.1, used in NGINX, was discovered to contain a control flow hijack caused by a Type Confusion vulnerability in njspromiseperformthen...

ALPINE-CVE-2021-46463

njs through 0.7.1, used in NGINX, was discovered to contain a control flow hijack caused by a Type Confusion vulnerability in njspromiseperformthen...

CVE-2021-46462

njs through 0.7.1, used in NGINX, was discovered to contain a segmentation violation via njsobjectsetprototype in /src/njsobject.c...

CVE-2021-46461

njs through 0.7.0, used in NGINX, was discovered to contain an out-of-bounds array access via njsvmcodetypeof in /src/njsvmcode.c...

ALPINE-CVE-2021-46462

njs through 0.7.1, used in NGINX, was discovered to contain a segmentation violation via njsobjectsetprototype in /src/njsobject.c...

Type confusion

njs through 0.7.1, used in NGINX, was discovered to contain a control flow hijack caused by a Type Confusion vulnerability in njspromiseperformthen...

Heap overflow

njs through 0.7.0, used in NGINX, was discovered to contain a heap use-after-free in njsawaitfulfilled...

Code injection

njs through 0.7.1, used in NGINX, was discovered to contain a segmentation violation via njsobjectsetprototype in /src/njsobject.c...

Out-of-bounds

njs through 0.7.0, used in NGINX, was discovered to contain an out-of-bounds array access via njsvmcodetypeof in /src/njsvmcode.c...

CVE-2021-46463

CVE-2021-46463: In njs (used in NGINX) up to version 0.7.1, a Type Confusion in njs_promise_perform_then() enables control-flow hijack. NVD lists high/critical scores (CVSS v3.1: 9.8) with network attacker, no user interaction. Affected: njs within NGINX. Remediation/fix not specified in the prov...