CVE-2026-18329

Summary

Description

NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request that triggers an error condition in the access validation logic. This may cause the js_access phase to fail open, allowing the request to proceed instead of being denied, resulting in an authentication or authorization bypass and unauthorized access to protected resources.

Impact

This vulnerability may allow remote attackers to bypass js_access controls. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected Software

Weaknesses

• CWE-636: CWE-636

Workarounds

• To secure your NGINX njs js_access handler against unhandled exceptions such as JSON.parse failures, wrap your logic in a robust try/catch block with a default strict deny policy that returns an HTML 403 Forbidden response code. For example:async function auth(r) {   try {     // 1. Guard input: Safely check for the Authorization header     var authHeader = r.headersIn ? r.headersIn.Authorization : undefined;     if (!authHeader) {       r.warn("Access Denied: Missing Authorization header.");       return r.return(401);     }     // 2. Perform the async HTTP request     let reply = await ngx.fetch(' http://authsvc/check ', {       headers: { Authorization: authHeader }     });     // 3. Validate response status     if (reply.status !== 200) {       r.warn(Access Denied: Auth service returned status ${reply.status});       return r.return(401);     }     // 4. Read response body     // Note: ngx.fetch body is read asynchronously using .text() or .json()     let responseText = await reply.text();     let payload = {};     // 5. Guard JSON.parse explicitly     try {       payload = JSON.parse(responseText);     } catch (jsonError) {       r.error(Security Warning: Failed to parse auth service JSON payload: ${jsonError.message});       // Explicitly deny the request due to malformed auth response payload       return r.return(403);     }     // 6. Validate the contents of the parsed JSON     if (payload.authorized !== true) {       r.warn("Access Denied: Client token validated but not authorized.");       return r.return(403);     }     // 7. Success: Explicitly allow the request to proceed     return r.return(200);   } catch (globalError) {     // 8. Global Catch-All: Block the bypass vulnerability on any script exception     r.error(Security Critical: Unhandled exception in auth handler: ${globalError.toString()});     // Always return 403 (Deny) on exception to guarantee a fail-closed state.     return r.return(403);   } } export default { auth };

• Place a security enforcement layer such as F5 WAF for NGINX or BIG-IP Advanced WAF before NGINX njs to prevent malformed requests. Configure the WAF to do the following: * Validate JSON syntax Enforce request body limits Block malformed payloads

• Reject unexpected content types Apply API schema validation

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://my.f5.com/manage/s/article/K000162599

• ←Previous
• Next→