8483 matches found
CVE-2026-78222
A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote...
CVE-2026-78689
NGINX JavaScript (njs) contains a heap-based buffer overflow (CWE-122) in the XML module's namespace prefix list parser, reachable via the xml.exclusiveC14n() method. Both the njs and QuickJS (qjs) engines are affected. With njs, the out-of-bounds write corrupts adjacent objects and crashes the N...
CVE-2026-77180
NGINX Ingress Controller is vulnerable to a configuration injection flaw (CWE-76) in its configuration generator. Multiple user-controllable Ingress annotation fields are written into the generated NGINX configuration without sanitization , allowing an authenticated attacker with Kubernetes API w...
CVE-2026-66362 NGF vulnerability
Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or...
CVE-2026-77180 NGINX Ingress Controller vulnerability
When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker...
CVE-2026-66362 NGF vulnerability
Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or...
EUVD-2026-70138
Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...
CVE-2026-18329 NGINX ngx_http_js_module vulnerability
Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...
CVE-2026-66362
CVE-2026-66362 is a configuration injection vulnerability in the NGINX configuration generator component of NGINX Gateway Fabric . When NGINX Plus is configured as the data plane, user-supplied values from the AuthenticationFilter CRD (clientID, cookieName) or the clientSecret field of a referenc...
CVE-2026-77180 NGINX Ingress Controller vulnerability
When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker...
CVE-2026-18329
Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...
EUVD-2026-70139
Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or...
EUVD-2026-70141
When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker...
CVE-2026-18329
NGINX JavaScript (njs) and QuickJS (qjs) engines contain an authentication/authorization bypass in the ngx_http_js_module . When a js_access handler performs asynchronous request body processing and an exception is thrown before an explicit denial is returned, the phase fails open , allowing unau...
K000162872: Out-of-band Security Notification (September 2, 2026)
Security Advisory Description On September 2, 2026, F5 announced the following security issues. This document is intended to serve as an index of these vulnerabilities and security exposures to help determine the impact to your F5 devices. You can find the details of each issue in the associated...
K000162602: NGINX ngx_http_js_module vulnerability CVE-2026-78689
Security Advisory Description NGINX JavaScript njs has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n method. An unauthenticated remote attacker can trigger it when an affected NGINX configuration passes an externally controlled XML...
K000162601: NGINX Ingress Controller vulnerability CVE-2026-77180
Security Advisory Description When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without...
K000162603: NGINX ngx_http_js_module vulnerability CVE-2026-78222
Security Advisory Description A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch can cause an NGINX worker to terminate unexpectedly when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP...
K000162600: NGINX Gateway Fabric vulnerability CVE-2026-66362
Security Advisory Description When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the AuthenticationFilter custom resource definition CR...
K000162599: NGINX ngx_http_js_module vulnerability CVE-2026-18329
Security Advisory Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An...