Description

Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request that triggers an error condition in the access validation logic. This may cause the js_access phase to fail open, allowing the request to proceed instead of being denied, resulting in an authentication or authorization bypass and unauthorized access to protected resources. Impact This vulnerability may allow remote attackers to bypass js_access controls. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-09-02T16:17:14.917Z",
  "pubdate": "2026-09-02T16:17:14.917Z",
  "executiveSummary": "This vulnerability involves an authorization bypass flaw within the NGINX JavaScript (njs) and QuickJS (qjs) engines affecting js_access handlers.\nThe issue manifests when asynchronous request body processing encounters an exception during access-control evaluation, causing the NGINX access phase to fail open.\nBy triggering a specific error condition in the validation logic, an unauthenticated remote attacker can bypass intended security constraints.\nThis is categorized as a data plane vulnerability, meaning it directly impacts the handling of client traffic rather than the NGINX control plane.\nThe primary risk implication is the unauthorized access to protected resources that should have been restricted by the js_access policy.\nSuccessful exploitation requires the attacker to send a crafted HTTP request designed to induce an exception state within the asynchronous execution context of the script engine.",
  "technicalDetails": "The vulnerability resides in the interaction between the NGINX request processing state machine and the asynchronous JavaScript execution environment provided by njs and qjs.\nThe root cause is a logic error in the error-handling path of the js_access phase. When a script handler is configured to process the HTTP request body asynchronously, it relies on a promise or callback mechanism to verify access credentials or authorization rules.\nIf an exception is raised within this asynchronous context—specifically before the handler can return an explicit 'deny' result—the NGINX access phase fails to catch or handle the failure state correctly. In this state, the engine defaults to a 'fail open' behavior, erroneously signaling to the core NGINX request handling module that the access validation has been satisfied.\nExploitation flow: 1. The attacker identifies a protected endpoint utilizing a js_access handler that performs asynchronous request body inspection. 2. The attacker crafts an HTTP request (typically containing specific malformed or unexpected body content) intended to trigger an unhandled exception within the JavaScript execution context. 3. Upon reaching the js_access phase, the NGINX/qjs engine initiates the request body processing. 4. The JavaScript engine encounters the exception during evaluation. 5. Due to the flawed error handling logic, the engine fails to propagate the denial status to the NGINX core. 6. The NGINX state machine treats the aborted execution as a successful access grant, allowing the request to proceed to the upstream server or local handler.\nThe scope of this vulnerability is limited to the data plane, impacting any NGINX deployment where njs or qjs is utilized for authorization logic. Because the vulnerability exists at the engine level, it bypasses the security policy entirely, effectively rendering authentication mechanisms transparent for the targeted request. No specialized privileges are required beyond the ability to send requests to the protected NGINX server, as the trigger mechanism relies on the server-side interpretation of the provided HTTP traffic."
}