{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-18329", "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "state": "PUBLISHED", "assignerShortName": "f5", "dateReserved": "2026-07-29T19:42:43.485Z", "datePublished": "2026-09-02T15:40:54.115Z", "dateUpdated": "2026-09-02T17:56:59.397Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "modules": ["ngx_http_js_module"], "product": "NGINX JavaScript", "vendor": "F5", "versions": [{"lessThan": "1.0.1", "status": "affected", "version": "1.0.0", "versionType": "custom"}, {"lessThan": "*", "status": "affected", "version": "0.9.9", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "F5 acknowledges Ta Duc Thien (@thientd) of NTCS for bringing this issue to our attention and following the highest standards of coordinated disclosure."}], "datePublic": "2026-08-19T14:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Description<br><br>NGINX JavaScript (njs)&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">and QuickJS (qjs) engines</span>&nbsp;have a vulnerability when a js_access handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request that triggers an error condition in the access validation logic. This may cause the js_access phase to fail open, allowing the request to proceed instead of being denied, resulting in an authentication or authorization bypass and unauthorized access to protected resources.<br><br>Impact<br><br>This vulnerability may allow remote attackers to bypass js_access controls. There is no control plane exposure; this is a data plane issue only.<br><br>\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."}], "value": "Description\n\nNGINX JavaScript (njs)\u00a0and QuickJS (qjs) engines\u00a0have a vulnerability when a js_access handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request that triggers an error condition in the access validation logic. This may cause the js_access phase to fail open, allowing the request to proceed instead of being denied, resulting in an authentication or authorization bypass and unauthorized access to protected resources.\n\nImpact\n\nThis vulnerability may allow remote attackers to bypass js_access controls. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.8, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-636", "description": "CWE-636", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "shortName": "f5", "dateUpdated": "2026-09-02T15:40:54.115Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://my.f5.com/manage/s/article/K000162599"}], "source": {"discovery": "EXTERNAL"}, "title": "NGINX ngx_http_js_module vulnerability", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<ul><li>To secure your NGINX njs <strong>js_access</strong>&nbsp;handler against unhandled exceptions such as <strong>JSON.parse</strong>&nbsp;failures, wrap your logic in a robust try/catch block with a default strict deny policy that returns an HTML 403 Forbidden response code. For example:<p>async function auth(r) {<br>&nbsp; try {<br>&nbsp; &nbsp; // 1. Guard input: Safely check for the Authorization header<br>&nbsp; &nbsp; var authHeader = r.headersIn ? r.headersIn.Authorization : undefined;<br>&nbsp; &nbsp; if (!authHeader) {<br>&nbsp; &nbsp; &nbsp; r.warn(\"Access Denied: Missing Authorization header.\");<br>&nbsp; &nbsp; &nbsp; return r.return(401);<br>&nbsp; &nbsp; }<br>&nbsp; &nbsp; // 2. Perform the async HTTP request<br>&nbsp; &nbsp; let reply = await ngx.fetch('<a target=\"_blank\" rel=\"nofollow\" href=\"http://authsvc/check\">http://authsvc/check</a>', {<br>&nbsp; &nbsp; &nbsp; headers: { Authorization: authHeader }<br>&nbsp; &nbsp; });<br>&nbsp; &nbsp; // 3. Validate response status<br>&nbsp; &nbsp; if (reply.status !== 200) {<br>&nbsp; &nbsp; &nbsp; r.warn(`Access Denied: Auth service returned status ${reply.status}`);<br>&nbsp; &nbsp; &nbsp; return r.return(401);<br>&nbsp; &nbsp; }<br>&nbsp; &nbsp; // 4. Read response body<br>&nbsp; &nbsp; // Note: ngx.fetch body is read asynchronously using .text() or .json()<br>&nbsp; &nbsp; let responseText = await reply.text();<br>&nbsp; &nbsp; let payload = {};<br>&nbsp; &nbsp; // 5. Guard JSON.parse explicitly<br>&nbsp; &nbsp; try {<br>&nbsp; &nbsp; &nbsp; payload = JSON.parse(responseText);<br>&nbsp; &nbsp; } catch (jsonError) {<br>&nbsp; &nbsp; &nbsp; r.error(`Security Warning: Failed to parse auth service JSON payload: ${jsonError.message}`);<br>&nbsp; &nbsp; &nbsp; // Explicitly deny the request due to malformed auth response payload<br>&nbsp; &nbsp; &nbsp; return r.return(403);<br>&nbsp; &nbsp; }<br>&nbsp; &nbsp; // 6. Validate the contents of the parsed JSON<br>&nbsp; &nbsp; if (payload.authorized !== true) {<br>&nbsp; &nbsp; &nbsp; r.warn(\"Access Denied: Client token validated but not authorized.\");<br>&nbsp; &nbsp; &nbsp; return r.return(403);<br>&nbsp; &nbsp; }<br>&nbsp; &nbsp; // 7. Success: Explicitly allow the request to proceed<br>&nbsp; &nbsp; return r.return(200);<br>&nbsp; } catch (globalError) {<br>&nbsp; &nbsp; // 8. Global Catch-All: Block the bypass vulnerability on any script exception<br>&nbsp; &nbsp; r.error(`Security Critical: Unhandled exception in auth handler: ${globalError.toString()}`);<br>&nbsp; &nbsp; // Always return 403 (Deny) on exception to guarantee a fail-closed state.<br>&nbsp; &nbsp; return r.return(403);<br>&nbsp; }<br>}<br>export default { auth };</p></li><li>Place a security enforcement layer such as F5 WAF for NGINX or BIG-IP Advanced WAF before NGINX njs to prevent malformed requests. Configure the WAF to do the following:<ul><li>Validate JSON syntax Enforce request body limits Block malformed payloads</li><li>Reject unexpected content types Apply API schema validation</li></ul></li></ul>\n\n<br>"}], "value": "* To secure your NGINX njs js_access\u00a0handler against unhandled exceptions such as JSON.parse\u00a0failures, wrap your logic in a robust try/catch block with a default strict deny policy that returns an HTML 403 Forbidden response code. For example:async function auth(r) {\n\u00a0 try {\n\u00a0 \u00a0 // 1. Guard input: Safely check for the Authorization header\n\u00a0 \u00a0 var authHeader = r.headersIn ? r.headersIn.Authorization : undefined;\n\u00a0 \u00a0 if (!authHeader) {\n\u00a0 \u00a0 \u00a0 r.warn(\"Access Denied: Missing Authorization header.\");\n\u00a0 \u00a0 \u00a0 return r.return(401);\n\u00a0 \u00a0 }\n\u00a0 \u00a0 // 2. Perform the async HTTP request\n\u00a0 \u00a0 let reply = await ngx.fetch(' http://authsvc/check ', {\n\u00a0 \u00a0 \u00a0 headers: { Authorization: authHeader }\n\u00a0 \u00a0 });\n\u00a0 \u00a0 // 3. Validate response status\n\u00a0 \u00a0 if (reply.status !== 200) {\n\u00a0 \u00a0 \u00a0 r.warn(`Access Denied: Auth service returned status ${reply.status}`);\n\u00a0 \u00a0 \u00a0 return r.return(401);\n\u00a0 \u00a0 }\n\u00a0 \u00a0 // 4. Read response body\n\u00a0 \u00a0 // Note: ngx.fetch body is read asynchronously using .text() or .json()\n\u00a0 \u00a0 let responseText = await reply.text();\n\u00a0 \u00a0 let payload = {};\n\u00a0 \u00a0 // 5. Guard JSON.parse explicitly\n\u00a0 \u00a0 try {\n\u00a0 \u00a0 \u00a0 payload = JSON.parse(responseText);\n\u00a0 \u00a0 } catch (jsonError) {\n\u00a0 \u00a0 \u00a0 r.error(`Security Warning: Failed to parse auth service JSON payload: ${jsonError.message}`);\n\u00a0 \u00a0 \u00a0 // Explicitly deny the request due to malformed auth response payload\n\u00a0 \u00a0 \u00a0 return r.return(403);\n\u00a0 \u00a0 }\n\u00a0 \u00a0 // 6. Validate the contents of the parsed JSON\n\u00a0 \u00a0 if (payload.authorized !== true) {\n\u00a0 \u00a0 \u00a0 r.warn(\"Access Denied: Client token validated but not authorized.\");\n\u00a0 \u00a0 \u00a0 return r.return(403);\n\u00a0 \u00a0 }\n\u00a0 \u00a0 // 7. Success: Explicitly allow the request to proceed\n\u00a0 \u00a0 return r.return(200);\n\u00a0 } catch (globalError) {\n\u00a0 \u00a0 // 8. Global Catch-All: Block the bypass vulnerability on any script exception\n\u00a0 \u00a0 r.error(`Security Critical: Unhandled exception in auth handler: ${globalError.toString()}`);\n\u00a0 \u00a0 // Always return 403 (Deny) on exception to guarantee a fail-closed state.\n\u00a0 \u00a0 return r.return(403);\n\u00a0 }\n}\nexport default { auth };\n\n\n * Place a security enforcement layer such as F5 WAF for NGINX or BIG-IP Advanced WAF before NGINX njs to prevent malformed requests. Configure the WAF to do the following: * Validate JSON syntax Enforce request body limits Block malformed payloads\n * Reject unexpected content types Apply API schema validation"}], "x_generator": {"engine": "F5 SIRTBot v1.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-02T17:56:50.319435Z", "id": "CVE-2026-18329", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-02T17:56:59.397Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "modules": ["ngx_http_js_module"], "product": "NGINX JavaScript", "vendor": "F5", "versions": [{"lessThan": "1.0.1", "status": "affected", "version": "1.0.0", "versionType": "custom"}, {"lessThan": "*", "status": "affected", "version": "0.9.9", "versionType": "custom"}]}], "source": "f5sirt@f5.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Description\n\nNGINX JavaScript (njs)\u00a0and QuickJS (qjs) engines\u00a0have a vulnerability when a js_access handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request that triggers an error condition in the access validation logic. This may cause the js_access phase to fail open, allowing the request to proceed instead of being denied, resulting in an authentication or authorization bypass and unauthorized access to protected resources.\n\nImpact\n\nThis vulnerability may allow remote attackers to bypass js_access controls. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."}], "id": "CVE-2026-18329", "lastModified": "2026-09-03T16:37:52.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "f5sirt@f5.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "f5sirt@f5.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18329", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-02T17:56:50.319435Z", "version": "2.0.3"}}]}, "published": "2026-09-02T16:17:14.917", "references": [{"source": "f5sirt@f5.com", "url": "https://my.f5.com/manage/s/article/K000162599"}], "sourceIdentifier": "f5sirt@f5.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-636"}], "source": "f5sirt@f5.com", "type": "Secondary"}]}

{}