F5 Njs vulnerabilities

40 CVEs affecting F5 Njs, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-8711, published 2026-05-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-12206, published 2019-05-20. Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days. njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in nxt_utf8_encode in nxt_utf8.c.
CVE-2019-12207, published 2019-05-20. Critical severity, CVSS 9.8. EPSS: 1.8% chance of exploitation in the next 30 days. njs through 0.3.1, used in NGINX, has a heap-based buffer over-read in nxt_utf8_decode in nxt/nxt_utf8.c.
CVE-2022-29379, published 2022-05-25. Critical severity, CVSS 9.8. EPSS: 1.8% chance of exploitation in the next 30 days. Nginx NJS v0.7.3 was discovered to contain a stack overflow in the function njs_default_module_loader at /src/njs/src/njs_module.c. NOTE: multiple third parties dispute this report, e.g., the…
CVE-2022-27008, published 2022-04-14. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. nginx njs 0.7.2 is vulnerable to Buffer Overflow. Type confused in Array.prototype.concat() when a slow array appended element is fast array.
CVE-2019-12208, published 2019-05-20. Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days. njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in njs_function_native_call in njs/njs_function.c.
CVE-2021-46462, published 2022-02-14. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. njs through 0.7.1, used in NGINX, was discovered to contain a segmentation violation via njs_object_set_prototype in /src/njs_object.c.
CVE-2021-46463, published 2022-02-14. Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days. njs through 0.7.1, used in NGINX, was discovered to contain a control flow hijack caused by a Type Confusion vulnerability in njs_promise_perform_then().
CVE-2019-11839, published 2019-05-09. Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days. njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in Array.prototype.push after a resize, related to njs_array_prototype_push in njs/njs_array.c, because of njs_array_expand size…
CVE-2022-25139, published 2022-02-14. Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days. njs through 0.7.0, used in NGINX, was discovered to contain a heap use-after-free in njs_await_fulfilled.
CVE-2022-27007, published 2022-04-14. Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days. nginx njs 0.7.2 is affected suffers from Use-after-free in njs_function_frame_alloc() when it try to invoke from a restored frame saved with njs_function_frame_save().

Latest

CVE-2026-8711, published 2026-05-19. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location…
CVE-2023-27730, published 2023-04-09. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs_lvlhsh_find at src/njs_lvlhsh.c.
CVE-2023-27729, published 2023-04-09. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. Nginx NJS v0.7.10 was discovered to contain an illegal memcpy via the function njs_vmcode_return at src/njs_vmcode.c.
CVE-2023-27728, published 2023-04-09. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs_dump_is_recursive at src/njs_vmcode.c.
CVE-2023-27727, published 2023-04-09. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs_function_frame at src/njs_function.h.
CVE-2020-19695, published 2023-04-04. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. Buffer Overflow found in Nginx NJS allows a remote attacker to execute arbitrary code via the njs_object_property parameter of the njs/njs_vm.c function.
CVE-2020-19692, published 2023-04-04. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. Buffer Overflow vulnerabilty found in Nginx NJS v.0feca92 allows a remote attacker to execute arbitrary code via the njs_module_read in the njs_module.c file.
CVE-2022-43286, published 2022-10-28. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Nginx NJS v0.7.2 was discovered to contain a heap-use-after-free bug caused by illegal memory copy in the function njs_json_parse_iterator_call at njs_json.c.
CVE-2022-43285, published 2022-10-28. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Nginx NJS v0.7.4 was discovered to contain a segmentation violation in njs_promise_reaction_job. NOTE: the vendor disputes the significance of this report because NJS does not operate on untrusted…
CVE-2022-43284, published 2022-10-28. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. Nginx NJS v0.7.2 to v0.7.4 was discovered to contain a segmentation violation via njs_scope_valid_value at njs_scope.h. NOTE: the vendor disputes the significance of this report because NJS does not…