CVE-2019-12207

CVE-2019-12207 affects njs (through 0.3.1) used with NGINX, caused by a heap-based buffer over-read in nxt_utf8_decode (nxt/nxt_utf8.c). CVSS v3 base score 9.8 (CRITICAL) indicates high impact on confidentiality, integrity, and availability with network access and no authentication. The provided ...

CVE-2019-12206

CVE-2019-12206 affects NGINX with NJS up to 0.3.1, where a heap-based buffer overflow in nxt_utf8_encode (nxt/nxt_utf8.c) can be triggered by overly long data. Documented impact includes potential remote code execution or crashes; the issue is addressed in later NJS/NGINX advisories. Remediation ...

CVE-2019-12206

njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in nxtutf8encode in nxtutf8.c...

CVE-2019-12206

njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in nxtutf8encode in nxtutf8.c...

PT-2019-12699

Name of the Vulnerable Software and Affected Versions njs versions prior to 0.3.2 Description A heap-based buffer overflow issue exists in the njs function native call function located in njs/njs function.c. This issue affects njs, which is used in NGINX. Recommendations For versions prior to...

PT-2019-12698

Name of the Vulnerable Software and Affected Versions njs versions prior to 0.3.2 Description The issue is related to a heap-based buffer over-read in the nxt utf8 decode function, located in nxt/nxt utf8.c. This function is part of njs, which is used in NGINX. Recommendations For versions prior ...

CVE-2019-12207: Out-of-bounds Read

njs through 0.3.1, used in NGINX, has a heap-based buffer over-read in nxtutf8decode in nxt/nxtutf8.c...

PT-2019-12697

Name of the Vulnerable Software and Affected Versions njs versions prior to 0.3.2 Description The issue is a heap-based buffer overflow in the nxt utf8 encode function in nxt utf8.c. This function is part of njs, which is used in NGINX. Recommendations For versions prior to 0.3.2, update to versi...

CVE-2019-12208: Out-of-bounds Write

njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in njsfunctionnativecall in njs/njsfunction.c...

CVE-2019-12206: Out-of-bounds Write

njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in nxtutf8encode in nxtutf8.c...

CVE-2019-11837

njs through 0.3.1, used in NGINX, has a segmentation fault in String.prototype.toBytes for negative arguments, related to nxtutf8next in nxt/nxtutf8.h and njsstringoffset in njs/njsstring.c...

Heap overflow

njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in Array.prototype.push after a resize, related to njsarrayprototypepush in njs/njsarray.c, because of njsarrayexpand size mishandling...

CVE-2019-11838

njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in Array.prototype.splice after a resize, related to njsarrayprototypesplice in njs/njsarray.c, because of njsarrayexpand size mishandling...

CVE-2019-11839

njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in Array.prototype.push after a resize, related to njsarrayprototypepush in njs/njsarray.c, because of njsarrayexpand size mishandling...

CVE-2019-11837

njs through 0.3.1, used in NGINX, has a segmentation fault in String.prototype.toBytes for negative arguments, related to nxtutf8next in nxt/nxtutf8.h and njsstringoffset in njs/njsstring.c...

Heap overflow

njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in Array.prototype.splice after a resize, related to njsarrayprototypesplice in njs/njsarray.c, because of njsarrayexpand size mishandling...

CVE-2019-11838

njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in Array.prototype.splice after a resize, related to njsarrayprototypesplice in njs/njsarray.c, because of njsarrayexpand size mishandling...

Code injection

njs through 0.3.1, used in NGINX, has a segmentation fault in String.prototype.toBytes for negative arguments, related to nxtutf8next in nxt/nxtutf8.h and njsstringoffset in njs/njsstring.c...

CVE-2019-11839

njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in Array.prototype.push after a resize, related to njsarrayprototypepush in njs/njsarray.c, because of njsarrayexpand size mishandling...

CVE-2019-11839

CVE-2019-11839 affects the NGINX NJS component (njs up to 0.3.1). The vulnerability is a heap-based buffer overflow in Array.prototype.push after a resize, caused by mishandling the size in njs_array_expand (njs/njs_array.c). Red Hat and other sources confirm this is a year‑old entry, with common...