F5-K000162614: Medium severity F5 NGINX JavaScript (njs) vulnerability
NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests with malformed XML and can cause unbounded memory growth in long-lived NGINX worker processes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.0.2
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An unauthenticated attacker only needs to be able to send requests containing malformed XML that reaches njs xml.parse(). Repeated failures can accumulate unreleased libxml2 parser contexts in long-lived NGINX worker processes.
What is the practical impact on affected deployments?
The issue causes unbounded memory growth in NGINX worker processes over time. This can result in reduced availability as worker memory consumption increases.
How can I determine whether my deployment is exposed?
Exposure requires F5 NGINX JavaScript (njs) using the built-in njs engine and processing attacker-controlled XML through xml.parse(). Review njs request-handling code and logs for XML parsing failures, especially repeated malformed-XML errors.