{"id":"CVE-2022-43285","aliases":["BELL-CVE-2022-43285","EUVD-2022-46329","GHSA-fgh9-wfj4-j5gv"],"status":"disputed","title":"Nginx NJS v0.7.4 was discovered to contain a segmentation violation in njs_promise_reaction_job.","description":"Nginx NJS v0.7.4 was discovered to contain a segmentation violation in njs_promise_reaction_job. NOTE: the vendor disputes the significance of this report because NJS does not operate on untrusted input.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00868,"percentile":0.58996,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2022-10-28T00:00:00Z","modified":"2026-10-28T02:30:56Z","fixes":[{"ecosystem":"Alpaquita:stream","package":"nginx","fixed_in":["1.24.0-r11"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:stream","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.22.1-r0"},{"fixed":"1.24.0-r11"}]}]}],"products":[{"vendor":"f5","product":"njs"}],"references":[{"url":"https://github.com/nginx/njs/issues/533","tags":["x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43285","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fgh9-wfj4-j5gv"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-43285","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/43xxx/CVE-2022-43285.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-43285","description":"Nginx NJS v0.7.4 was discovered to contain a segmentation violation in njs_promise_reaction_job. NOTE: the vendor disputes the significance of this report because NJS does not operate on untrusted input.","status":"disputed","published":"2022-10-28T00:00:00Z","modified":"2025-05-07T14:02:39.732Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:34:25.618175Z"}],"euvd":[{"id":"EUVD-2022-46329","description":"Nginx NJS v0.7.4 was discovered to contain a segmentation violation in njs_promise_reaction_job. NOTE: the vendor disputes the significance of this report because NJS does not operate on untrusted input.","status":"published","published":"2022-10-28T00:00:00Z","modified":"2025-05-07T14:02:39Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:53.098709Z"}],"ghsa":[{"id":"GHSA-fgh9-wfj4-j5gv","title":"Nginx NJS v0.7.4 was discovered to contain a segmentation violation in njs_promise_reaction_job.","description":"Nginx NJS v0.7.4 was discovered to contain a segmentation violation in njs_promise_reaction_job.","status":"published","published":"2022-10-29T12:00:43Z","modified":"2025-05-07T15:31:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:02:10.218491Z"}],"nvd":[{"id":"CVE-2022-43285","description":"Nginx NJS v0.7.4 was discovered to contain a segmentation violation in njs_promise_reaction_job. NOTE: the vendor disputes the significance of this report because NJS does not operate on untrusted input.","status":"disputed","published":"2022-10-28T21:15:10.15Z","modified":"2026-06-17T05:06:13.48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:07:31.127985Z"}],"osv":[{"id":"BELL-CVE-2022-43285","status":"published","published":"2022-10-28T21:15:00Z","modified":"2026-01-26T09:32:57.060618Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"CVE-2022-43285","description":"Nginx NJS v0.7.4 was discovered to contain a segmentation violation in njs_promise_reaction_job. NOTE: the vendor disputes the significance of this report because NJS does not operate on untrusted input.","status":"published","published":"2022-10-28T00:00:00Z","modified":"2026-10-28T02:30:56.111407386Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:27.186787Z"}]}}