NGINX ngx_http_js_module vulnerabilityCVE-2026-18329

Why this deserves its current priority

CVSS is 8.2. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps F5/NGINX JavaScript (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for F5/NGINX JavaScript.
2. 2Review the reported fix. Source-reported workaround: * To secure your NGINX njs js_access handler against unhandled exceptions such as JSON.parse failures, wrap your logic in a robust try/catch block with a default strict deny policy that returns an HTML 403 Forbidden response code. For example:async function auth(r) {   try {     // 1. Guard input: Safely check for the Authorization header     var authHeader = r.headersIn ? r.headersIn.Authorization : undefined;     if (!authHeader) {       r.warn("Access Denied: Missing Authorization header.");       return r.return(401);     }     // 2. Perform the async HTTP request     let reply = await ngx.fetch(' http://authsvc/check ', {       headers: { Authorization: authHeader }     });     // 3. Validate response status     if (reply.status !== 200) {       r.warn(`Access Denied: Auth service returned status ${reply.status}`);       return r.return(401);     }     // 4. Read response body     // Note: ngx.fetch body is read asynchronously using .text() or .json()     let responseText = await reply.text();     let payload = {};     // 5. Guard JSON.parse explicitly     try {       payload = JSON.parse(responseText);     } catch (jsonError) {       r.error(`Security Warning: Failed to parse auth service JSON payload: ${jsonError.message}`);       // Explicitly deny the request due to malformed auth response payload       return r.return(403);     }     // 6. Validate the contents of the parsed JSON     if (payload.authorized !== true) {       r.warn("Access Denied: Client token validated but not authorized.");       return r.return(403);     }     // 7. Success: Explicitly allow the request to proceed     return r.return(200);   } catch (globalError) {     // 8. Global Catch-All: Block the bypass vulnerability on any script exception     r.error(`Security Critical: Unhandled exception in auth handler: ${globalError.toString()}`);     // Always return 403 (Deny) on exception to guarantee a fail-closed state.     return r.return(403);   } } export default { auth }; * Place a security enforcement layer such as F5 WAF for NGINX or BIG-IP Advanced WAF before NGINX njs to prevent malformed requests. Configure the WAF to do the following: * Validate JSON syntax Enforce request body limits Block malformed payloads * Reject unexpected content types Apply API schema validation

Evidence timeline and material changes

1. Published upstream

   Sep 2, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 3, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Sep 2, 2026

Sources and claim methodology

• Source referencemy.f5.com

Related CVEs

• WordPress SMS Alert Order Notifications plugin <= 4.0.1 - Broken Access Control vulnerabilitySame generic ecosystem
• phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO CallbacksSame generic ecosystem
• phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account TakeoverSame generic ecosystem
• phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup APISame generic ecosystem
• phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor EndpointSame generic ecosystem
• phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment EndpointSame generic ecosystem