CVE-2026-101025: NGINX ngx_http_js_module vulnerability
Description
NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests with malformed XML and can cause unbounded memory growth in long-lived NGINX worker processes.
Impact
This vulnerability may allow remote attackers to send requests that trigger repeated parsing of malformed XML and may lead to NGINX worker termination or denial of service. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects the data plane, specifically long-lived NGINX worker processes that repeatedly parse attacker-supplied malformed XML through the built-in njs engine. There is no control plane exposure described.
What does an attacker need to do to trigger the denial of service?
An unauthenticated remote attacker needs to send requests containing malformed XML that causes xml.parse() to fail. Repeated requests can leak parser contexts and drive unbounded memory growth until workers terminate.
Can this affect an NGINX deployment without authenticated access?
Yes. The described attack requires no privileges or user interaction; malformed XML can be supplied by an unauthenticated remote attacker.
How can operators determine whether they are being affected?
Look for sustained or increasing memory consumption in long-lived NGINX worker processes, particularly alongside requests that trigger XML parsing failures. The described outcome is worker termination or denial of service after repeated malformed-XML parsing.