njs through 0.7.1, used in NGINX, was discovered to contain a control flow hijack caused by a Type Confusion vulnerability in njspromiseperformthen().
njs through 0.7.0, used in NGINX, was discovered to contain a heap use-after-free in njsawaitfulfilled.
njs through 0.3.3, used in NGINX, has a buffer over-read in nxtutf8decode in nxt/nxtutf8.c. This issue occurs after the fix for CVE-2019-12207 is in place.
njs through 0.3.1, used in NGINX, has a heap-based buffer over-read in nxtutf8decode in nxt/nxtutf8.c.
njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in Array.prototype.splice after a resize, related to njsarrayprototypesplice in njs/njsarray.c, because of njsarrayexpand size mishandling.
njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in njsfunctionnativecall in njs/njsfunction.c.
njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in Array.prototype.push after a resize, related to njsarrayprototypepush in njs/njsarray.c, because of njsarrayexpand size mishandling.
njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in nxtutf8encode in nxtutf8.c.
nginx njs 0.7.2 is affected suffers from Use-after-free in njsfunctionframealloc() when it try to invoke from a restored frame saved with njsfunctionframesave().
DISPUTED Nginx NJS v0.7.3 was discovered to contain a stack overflow in the function njsdefaultmoduleloader at /src/njs/src/njsmodule.c. NOTE: multiple third parties dispute this report, e.g., the behavior is only found in unreleased development code that was not part of the 0.7.2, 0.7.3, or 0.7.4 release.
Nginx NJS v0.7.2 was discovered to contain a heap-use-after-free bug caused by illegal memory copy in the function njsjsonparseiteratorcall at njsjson.c.
NGINX JavaScript has a vulnerability when the jsfetchproxy directive is configured with at least one client-controlled NGINX variable (for example, $http, $arg, $cookie) and a location invoking the ngx.fetch() operation from NGINX JavaScript. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Nginx NJS v0.7.4 was discovered to contain an out-of-bounds read via njsscopevalue at njsscope.h.
njs through 0.4.3, used in NGINX, has a use-after-free in njsjsonparseiteratorcall in njsjson.c.
njs through 0.7.1, used in NGINX, was discovered to contain a segmentation violation via njsobjectsetprototype in /src/njsobject.c.
njs through 0.3.1, used in NGINX, has a segmentation fault in String.prototype.toBytes for negative arguments, related to nxtutf8next in nxt/nxtutf8.h and njsstringoffset in njs/njsstring.c.
nginx njs 0.7.2 is vulnerable to Buffer Overflow. Type confused in Array.prototype.concat() when a slow array appended element is fast array.
Nginx NJS v0.7.2 was discovered to contain a segmentation violation via njslvlhshbucketfind at njslvlhsh.c.
Nginx NJS v0.7.5 was discovered to contain a segmentation violation via njsutf8next at src/njsutf8.h.
Nginx NJS v0.7.5 was discovered to contain a segmentation violation in the function njsvalueownenumerate at src/njsvalue.c.
Nginx NJS v0.7.5 was discovered to contain a segmentation violation via njsvaluetonumber at src/njsvalueconversion.h.
Nginx NJS v0.7.5 was discovered to contain a segmentation violation via njsdjbhash at src/njsdjbhash.c.
Nginx NJS v0.7.4 was discovered to contain a segmentation violation via njsvalueproperty at njsvalue.c.
DISPUTED Nginx NJS v0.7.2 to v0.7.4 was discovered to contain a segmentation violation via njsscopevalidvalue at njsscope.h. NOTE: the vendor disputes the significance of this report because NJS does not operate on untrusted input.
DISPUTED Nginx NJS v0.7.4 was discovered to contain a segmentation violation in njspromisereactionjob. NOTE: the vendor disputes the significance of this report because NJS does not operate on untrusted input.
Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njsdumpisrecursive at src/njsvmcode.c.
Nginx NJS v0.7.10 was discovered to contain an illegal memcpy via the function njsvmcodereturn at src/njsvmcode.c.
Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njslvlhshfind at src/njslvlhsh.c.
Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njsfunctionframe at src/njsfunction.h.
njs through 0.3.3, used in NGINX, has a heap-based buffer over-read in nxtvsprintf in nxt/nxtsprintf.c during error handling, as demonstrated by an njsregexpliteral call that leads to an njsparserlexererror call and then an njsparserscopeerror call.