CVE-2026-101025NGINX ngx_http_js_module vulnerability
Updated under an hour ago ()
Does this affect you?
It affects F5 NGINX JavaScript. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests with malformed XML and can cause unbounded memory growth in long-lived NGINX worker processes. Impact This vulnerability may allow remote attackers to send requests that trigger repeated parsing of malformed XML and may lead to NGINX worker termination or denial of service. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- CVSS
- 5.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Weakness (CWE)
- CWE-401
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- f5
- NVD analysis
- Awaiting Analysis
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 14, 2026
Affected products
F5 NGINX JavaScript f5:nginx_javascript (from the name) | from 0.7.10 before 1.0.2 | CNA record |
References
- https://my.f5.com/manage/s/article/K000162614vendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.