Every CVE Search/ Get API key

CVE-2021-46461

njs through 0.7.0, used in NGINX, was discovered to contain an out-of-bounds array access via...

9.8 CriticalFix available

njs through 0.7.0, used in NGINX, was discovered to contain an out-of-bounds array access via njs_vmcode_typeof in /src/njs_vmcode.c.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

3.15%Up 2.3 points since Feb 15, 2022
90%50%10%1%

What each source reports

NVD Score used 9.8

njs through 0.7.0, used in NGINX, was discovered to contain an out-of-bounds array access via njs_vmcode_typeof in /src/njs_vmcode.c.

Record
CVE-2021-46461
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

njs through 0.7.0, used in NGINX, was discovered to contain an out-of-bounds array access via njs_vmcode_typeof in /src/njs_vmcode.c.

Record
CVE-2021-46461
Updated
2026-11-02
EUVDEUVD-2021-33137 No score

njs through 0.7.0, used in NGINX, was discovered to contain an out-of-bounds array access via njs_vmcode_typeof in /src/njs_vmcode.c.

Record
EUVD-2021-33137
Updated
2026-11-03
GitHub AdvisoriesGHSA-8g5q-f4mq-w57g 9.8

njs through 0.7.0, used in NGINX, was discovered to contain an out-of-bounds array access via...

njs through 0.7.0, used in NGINX, was discovered to contain an out-of-bounds array access via njs_vmcode_typeof in /src/njs_vmcode.c.

Record
GHSA-8g5q-f4mq-w57g
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-119
Updated
2026-11-02
OSVALPINE-CVE-2021-46461 9.8

njs through 0.7.0, used in NGINX, was discovered to contain an out-of-bounds array access via njs_vmcode_typeof in /src/njs_vmcode.c.

Record
ALPINE-CVE-2021-46461
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVBELL-CVE-2021-46461 9.8

CVE-2021-46461 does not affect BellSoft software

Record
BELL-CVE-2021-46461
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 9.8

njs through 0.7.0, used in NGINX, was discovered to contain an out-of-bounds array access via njs_vmcode_typeof in /src/njs_vmcode.c.

Record
CVE-2021-46461
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nginx
Alpine:v3.16
 before 1.20.2-r2
1.20.2-r2
nginx
Alpine:v3.17
 before 1.20.2-r2
1.20.2-r2
nginx
Alpine:v3.18
 before 1.20.2-r2
1.20.2-r2
nginx
Alpine:v3.19
 before 1.20.2-r2
1.20.2-r2
nginx
Alpine:v3.20
 before 1.20.2-r2
1.20.2-r2
nginx
Alpine:v3.21
 before 1.20.2-r2
1.20.2-r2
nginx
Alpine:v3.22
 before 1.20.2-r2
1.20.2-r2
nginx
Alpine:v3.23
 before 1.20.2-r2
1.20.2-r2
nginx
Alpine:v3.24
 before 1.20.2-r2
1.20.2-r2
njs
Alpine:v3.15
 before 0.7.1-r0
0.7.1-r0
Show 9 moreShow less
Affected packages
PackageAffectedFixed
njs
Alpine:v3.16
 before 0.7.1-r0
0.7.1-r0
njs
Alpine:v3.17
 before 0.7.1-r0
0.7.1-r0
njs
Alpine:v3.18
 before 0.7.1-r0
0.7.1-r0
njs
Alpine:v3.19
 before 0.7.1-r0
0.7.1-r0
njs
Alpine:v3.20
 before 0.7.1-r0
0.7.1-r0
njs
Alpine:v3.21
 before 0.7.1-r0
0.7.1-r0
njs
Alpine:v3.22
 before 0.7.1-r0
0.7.1-r0
njs
Alpine:v3.23
 before 0.7.1-r0
0.7.1-r0
njs
Alpine:v3.24
 before 0.7.1-r0
0.7.1-r0

History

History
RecordedChangedSources
affectedOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-46461 is a critical vulnerability (CVSS 9.8) in Nginx Njs, published February 14, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.15%, the 88th percentile. Fixed in nginx 1.20.2-r2.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open