CVE-2026-78222: NGINX ngx_http_js_module vulnerability
A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response.
Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Software
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Deployments are exposed where ngx_http_js_module uses ngx.fetch() and trusted JavaScript reads Response.statusText. The issue is in the data plane only; no control plane exposure is described.
What does an attacker need to exploit this?
An attacker must be able to control or influence the HTTP response fetched through ngx.fetch(). A malformed fetched response can then crash an NGINX worker when the JavaScript reads Response.statusText.
What is the practical impact?
The documented impact is denial of service through an NGINX worker crash. No confidentiality or integrity impact is stated.
Are unsupported versions covered by the assessment?
No. Software versions that have reached End of Technical Support are not evaluated.