CVE-2026-78222

Summary

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response.

Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected Software

Weaknesses

• CWE-476: CWE-476 NULL Pointer Dereference

Workarounds

Restrict ngx.fetch() destinations to trusted servers and avoid reading Response.statusText for responses from attacker-controlled or attacker-influenced endpoints. Using HTTPS with certificate verification reduces exposure to network-based response manipulation but does not protect against a malicious or compromised fetched server

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://my.f5.com/manage/s/article/K000162603

• ←Previous
• Next→