SB2026090741 - Multiple vulnerabilities in NGINX JavaScript

Description

This security bulletin contains information about 3 vulnerabilities.

1) Not Failing Securely ('Failing Open') (CVE-ID: CVE-2026-18329)

CWE-ID: CWE-636 - Not Failing Securely (\'Failing Open\')

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass authentication or authorization controls.

The vulnerability exists due to failing open in the ngx_http_js_module when the js_access handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. A remote attacker can send a crafted HTTP request that triggers an error condition in the access validation logic to bypass authentication or authorization controls.

The issue affects the data plane only and does not expose the control plane.

2) NULL pointer dereference (CVE-ID: CVE-2026-78222)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to null pointer dereference in the ngx_http_js_module module when trusted JavaScript reads Response.statusText from a malformed HTTP response received by ngx.fetch(). A remote attacker can control or influence the fetched HTTP response to cause a denial of service.

This is a data plane issue only and does not expose the control plane.

3) Heap-based buffer overflow (CVE-ID: CVE-2026-78689)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially execute arbitrary code or cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in the XML module\'s namespace prefix list parser in ngx_http_js_module when an affected NGINX configuration passes an externally controlled XML namespace prefix list to xml.exclusiveC14n(). A remote attacker can submit a crafted XML namespace prefix list to potentially execute arbitrary code or cause a denial of service.

The official nginxinc/nginx-saml reference implementation processes untrusted SAML namespace prefix lists during signature verification before the signature is verified.

Remediation

Install update from vendor's website.

References

• https://my.f5.com/manage/s/article/K000162599
• https://my.f5.com/manage/s/article/K000162603
• https://my.f5.com/manage/s/article/K000162602