CVE-2026-18329
Received Received - Intake

js_access Bypass in NGINX JavaScript (njs) Engine

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: F5 Networks

Description
Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request that triggers an error condition in the access validation logic. This may cause the js_access phase to fail open, allowing the request to proceed instead of being denied, resulting in an authentication or authorization bypass and unauthorized access to protected resources. Impact This vulnerability may allow remote attackers to bypass js_access controls. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-18329
EUVD
EUVD-2026-70138

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nginx nginx *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-636 When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects NGINX JavaScript (njs) and QuickJS (qjs) engines when a js_access handler processes asynchronous request body requests and an exception occurs during access-control evaluation before denial. An attacker can send a crafted HTTP request to trigger an error, causing the js_access phase to fail open and bypass authentication or authorization controls.

Detection Guidance

Detecting this vulnerability requires monitoring for unexpected access control bypasses in NGINX JavaScript (njs) or QuickJS (qjs) handlers. Check NGINX logs for js_access phase failures or errors during request processing. Look for requests that should be denied but are allowed due to the vulnerability. Ensure your js_access handlers are not performing asynchronous body processing that could trigger this issue.

Impact Analysis

This vulnerability allows unauthenticated attackers to bypass js_access controls, potentially gaining unauthorized access to protected resources. It does not affect the control plane, only the data plane, meaning it impacts data processing and access rather than system management.

Compliance Impact

This vulnerability allows unauthorized access to protected resources by bypassing authentication or authorization controls. For GDPR, this could lead to unauthorized data access, violating principles of data protection and user rights. For HIPAA, it may result in unauthorized access to protected health information, compromising confidentiality requirements.

Mitigation Strategies

Update NGINX JavaScript (njs) and QuickJS (qjs) to the latest patched versions immediately to address the js_access handler flaw. Disable asynchronous request body processing in js_access handlers if not required. Review and tighten access control policies to ensure proper denial responses are enforced.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18329. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart