Not Failing Securely ('Failing Open') in NGINX JavaScript - CVE-2026-18329
Published: September 7, 2026
Vulnerability identifier: #VU147228
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-18329
CWE-ID: CWE-636
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication or authorization controls.
The vulnerability exists due to failing open in the ngx_http_js_module when the js_access handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. A remote attacker can send a crafted HTTP request that triggers an error condition in the access validation logic to bypass authentication or authorization controls.
The issue affects the data plane only and does not expose the control plane.
Affected software
NGINX JavaScript
How to mitigate CVE-2026-18329
Install security update from vendor's website.
NGINX JavaScript - update to 1.0.1