CVE-2026-78222

HighCVSS 7.5/10Last modified Sep 2, 2026

Description

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response.

Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
F5	NGINX JavaScript	>= 0.5.1, < 1.0.1

References

https://my.f5.com/manage/s/article/K000162603

Timeline

Published: Sep 2, 2026
Last modified: Sep 2, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-782236.9Improper Verification of Cryptographic Signature vulnerability in team-alembic AshAuthentication allows a caller of the token revocation act CVE-2026-782248.2The XSLT Transformer Step builds a bare TransformerFactory without the proper security options set, so XXE injection can allow data exfiltra CVE-2026-782259.0A hardcoded cryptographic server key vulnerability exists in the deployer-ng Update Controller component of Wärtsilä FOS-Onboard.CVE-2026-782276.5NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--wit CVE-2026-782285.9Uncontrolled Recursion vulnerability in ash-project ash_oban allows a user who can drive a trigger's on_error action to fail on the final at CVE-2026-782296.7Image Scanner Driver for Linux contains an OS command injection vulnerability. An attacker who can log in to a Linux system where the affect CVE-2026-78239.8A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function setAppFilterCfg of the file /cgi-bin/c CVE-2026-782306.0AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, avg) that builds CVE-2026-782315.3When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied O CVE-2026-782349.9A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace CVE-2026-782368.8An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross CVE-2026-782377.8Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, resulting in persistent