F5 Nginx JavaScript vulnerabilities

5 CVEs affecting F5 Nginx JavaScript, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-101025, published 2026-10-14.

More from F5.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-78689, published 2026-09-02. High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days. Description NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n() method. An unauthenticated remote attacker can…
• CVE-2026-78222, published 2026-09-02. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires…
• CVE-2026-18329, published 2026-09-02. High severity, CVSS 8.2. EPSS: 0.4% chance of exploitation in the next 30 days. Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and an exception is thrown during…
• CVE-2026-101025, published 2026-10-14. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanup and the context…
• CVE-2026-101019, published 2026-10-14. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS…