Description

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-02T16:17:23.557Z",
  "pubdate": "2026-09-02T16:17:23.557Z",
  "executiveSummary": "A memory corruption vulnerability exists within the NGINX JavaScript (njs) module, specifically affecting the handling of malformed HTTP responses initiated via ngx.fetch().\nThe vulnerability is triggered when the njs runtime attempts to parse and access the statusText property of a Response object derived from an attacker-controlled or malicious HTTP server response.\nSuccessful exploitation results in an immediate crash of the NGINX worker process, leading to a Denial-of-Service (DoS) condition.\nThis issue resides exclusively within the data plane, meaning an attacker must be able to influence the HTTP response returned to the NGINX instance during a fetch operation.\nNo control plane exposure or remote code execution is currently associated with this flaw; however, the potential for persistent service instability makes this a significant availability risk for environments heavily reliant on the njs module for backend communication.\nThere are no specific authentication or privilege requirements for the attacker, provided they can successfully intercept or control the upstream response headers processed by the target NGINX node.",
  "technicalDetails": "The root cause of this vulnerability lies in improper input validation and memory management within the njs module when interacting with the Fetch API interface. Specifically, when the ngx.fetch() function retrieves an HTTP response containing malformed data in the status line or header fields, the internal C-level structures responsible for mapping the Response.statusText attribute fail to process the input safely.\nThe vulnerability is triggered when user-authored JavaScript code attempts to access the statusText property of a response object returned by ngx.fetch(). If the underlying HTTP response contains unexpected or crafted characters within the status text field, the njs engine encounters an unhandled exception or illegal memory access state during the conversion of the raw byte stream into a JavaScript string object.\nThe attack flow follows a structured sequence: First, the attacker ensures they are in a position to influence the HTTP traffic returned to the NGINX server. This can be achieved through server-side request forgery (SSRF), controlling an upstream service being fetched, or performing a Man-in-the-Middle (MitM) attack if the connection is unencrypted or the attacker has access to the transit path. Second, the attacker causes the NGINX instance to initiate an ngx.fetch() call to the controlled endpoint. Third, the attacker returns a response with a maliciously crafted status text field designed to violate the parser's expected memory layout. Fourth, the target NGINX JavaScript environment executes code that reads this property, resulting in a segmentation fault or similar memory violation.\nBecause NGINX operates on a multi-worker process model, a crash caused by this vulnerability forces the termination of the specific worker process handling the request. While the NGINX master process typically spawns new workers, an attacker capable of generating high-frequency malicious responses can effectively keep the service in a perpetual crash-restart loop, thereby denying service to legitimate users.\nThe vulnerable component is identified as the njs module responsible for handling the Fetch API's Response object properties. As this is a data plane issue, it affects the processing logic of live HTTP traffic flows. Mitigation is dependent on filtering upstream responses or updating the njs module to a version that implements rigorous length and character set validation for HTTP status line parsing."
}