Every CVE Search/ Get API key

CVE-2026-78222

NGINX ngx_http_js_module vulnerability

8.7 HighFix available

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response.

Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.62%Up 0.3 points since Sep 3, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.7

NGINX ngx_http_js_module vulnerability

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response.

Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
CVE-2026-78222
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
EUVDEUVD-2026-70144 8.7

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response.

Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
EUVD-2026-70144
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-27f9-cgjj-wvcv 8.7

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch(...

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response.

Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
GHSA-27f9-cgjj-wvcv
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
NVD 8.7

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response.

Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
CVE-2026-78222
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSVDEBIAN-CVE-2026-78222 8.7

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
DEBIAN-CVE-2026-78222
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVUBUNTU-CVE-2026-78222 8.7

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
UBUNTU-CVE-2026-78222
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-99300 No score

CVE-2026-78222 affecting package nginx for versions less than 1.30.4-1

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response.

Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
AZL-99300
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nginx
Azure Linux:3
 before 1.30.4-1
1.30.4-1
libnginx-mod-js
Debian:12
 All versions, plus listed versions
0.7.12-10.7.12-20.7.12-2~exp10.7.12-2~exp20.7.9-2
Show 17 moreShow less
0.8.0-10.8.1-10.8.2-10.8.4-10.8.5-10.8.9-10.9.1-10.9.4-10.9.6-10.9.8-10.9.9-10.9.9-21.0.0-11.0.0-21.0.0-31.0.0-41.0.1-1
 None known
libnginx-mod-js
Debian:13
 All versions, plus listed versions
0.8.9-10.9.1-10.9.4-10.9.6-10.9.8-1
Show 7 moreShow less
0.9.9-10.9.9-21.0.0-11.0.0-21.0.0-31.0.0-41.0.1-1
 None known
libnginx-mod-js
Debian:14
 before 1.0.1-1, plus listed versions
0.8.9-10.9.1-10.9.4-10.9.6-10.9.8-1
Show 6 moreShow less
0.9.9-10.9.9-21.0.0-11.0.0-21.0.0-31.0.0-4
1.0.1-1
libnginx-mod-js
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.7.12-20.8.2-1ubuntu1
 None known
libnginx-mod-js
Ubuntu:26.10
 All versions, plus listed versions
0.9.4-1build20.9.9-21.0.0-11.0.0-3
 None known
libnginx-mod-js
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
0.9.1-1ubuntu20.9.1-1ubuntu30.9.4-1~build10.9.4-10.9.4-1build10.9.4-1build20.9.4-1ubuntu0.1~esm1
 None known

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-78222 is a high vulnerability (CVSS 8.7) in F5 Nginx Javascript, published September 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.62%, the 50th percentile. Fixed in nginx 1.30.4-1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open