NGINX JavaScript has a vulnerability when the jsfetchproxy directive is configured with at least one client-controlled NGINX variable (for example, $http, $arg, $cookie) and a location invoking the ngx.fetch() operation from NGINX JavaScript. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njsdumpisrecursive at src/njsvmcode.c.
Nginx NJS v0.7.10 was discovered to contain an illegal memcpy via the function njsvmcodereturn at src/njsvmcode.c.
Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njslvlhshfind at src/njslvlhsh.c.
Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njsfunctionframe at src/njsfunction.h.
Nginx NJS v0.7.2 was discovered to contain a heap-use-after-free bug caused by illegal memory copy in the function njsjsonparseiteratorcall at njsjson.c.
DISPUTED Nginx NJS v0.7.2 to v0.7.4 was discovered to contain a segmentation violation via njsscopevalidvalue at njsscope.h. NOTE: the vendor disputes the significance of this report because NJS does not operate on untrusted input.
DISPUTED Nginx NJS v0.7.4 was discovered to contain a segmentation violation in njspromisereactionjob. NOTE: the vendor disputes the significance of this report because NJS does not operate on untrusted input.
Nginx NJS v0.7.7 was discovered to contain a segmentation violation via njsutf8next at src/njsutf8.h
Nginx NJS v0.7.5 was discovered to contain a segmentation violation in the function njsvalueownenumerate at src/njsvalue.c.
Nginx NJS v0.7.5 was discovered to contain a segmentation violation via njsvaluetonumber at src/njsvalueconversion.h.
Nginx NJS v0.7.5 was discovered to contain a segmentation violation via njsdjbhash at src/njsdjbhash.c.
Nginx NJS v0.7.4 was discovered to contain an out-of-bounds read via njsscopevalue at njsscope.h.
Nginx NJS v0.7.5 was discovered to contain a segmentation violation via njsutf8next at src/njsutf8.h.
Nginx NJS v0.7.4 was discovered to contain a segmentation violation via njsvalueproperty at njsvalue.c.
Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njsvmcodeinterpreter at src/njsvmcode.c.
Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njsstringoffset at src/njsstring.c.
Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njsarrayconverttoslowarray at src/njsarray.c.
DISPUTED Nginx NJS v0.7.3 was discovered to contain a stack overflow in the function njsdefaultmoduleloader at /src/njs/src/njsmodule.c. NOTE: multiple third parties dispute this report, e.g., the behavior is only found in unreleased development code that was not part of the 0.7.2, 0.7.3, or 0.7.4 release.
Nginx NJS v0.7.2 was discovered to contain a segmentation violation via njslvlhshbucketfind at njslvlhsh.c.
NGINX NJS 0.7.2 was discovered to contain a NULL pointer dereference via the component njsvmcodearray at /src/njsvmcode.c.
nginx njs 0.7.2 is affected suffers from Use-after-free in njsfunctionframealloc() when it try to invoke from a restored frame saved with njsfunctionframesave().
nginx njs 0.7.2 is vulnerable to Buffer Overflow. Type confused in Array.prototype.concat() when a slow array appended element is fast array.
njs through 0.7.1, used in NGINX, was discovered to contain a control flow hijack caused by a Type Confusion vulnerability in njspromiseperformthen().
njs through 0.7.0, used in NGINX, was discovered to contain a heap use-after-free in njsawaitfulfilled.
njs through 0.7.1, used in NGINX, was discovered to contain a segmentation violation via njsobjectsetprototype in /src/njsobject.c.
njs through 0.4.3, used in NGINX, has a use-after-free in njsjsonparseiteratorcall in njsjson.c.
njs through 0.4.3, used in NGINX, has an out-of-bounds read in njslvlhshlevelfind in njslvlhsh.c.
njs through 0.4.3, used in NGINX, has an out-of-bounds read in njsjsonstringifyiterator in njsjson.c.
njs through 0.4.3, used in NGINX, allows control-flow hijack in njsvalueproperty in njsvalue.c. NOTE: the vendor considers the issue to be "fluff" in the NGINX use case because there is no remote attack surface.