CVE-2026-78222

HighCVSS 7.5/10Last modified Sep 2, 2026

Description

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response.

Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 2, 2026
Last modified
Sep 2, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-782236.9Improper Verification of Cryptographic Signature vulnerability in team-alembic AshAuthentication allows a caller of the token revocation actCVE-2026-782248.2The XSLT Transformer Step builds a bare TransformerFactory without the proper security options set, so XXE injection can allow data exfiltraCVE-2026-782259.0A hardcoded cryptographic server key vulnerability exists in the deployer-ng Update Controller component of Wärtsilä FOS-Onboard.CVE-2026-782276.5NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--witCVE-2026-782285.9Uncontrolled Recursion vulnerability in ash-project ash_oban allows a user who can drive a trigger's on_error action to fail on the final atCVE-2026-782296.7Image Scanner Driver for Linux contains an OS command injection vulnerability. An attacker who can log in to a Linux system where the affectCVE-2026-78239.8A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function setAppFilterCfg of the file /cgi-bin/cCVE-2026-782306.0AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, avg) that buildsCVE-2026-782315.3When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OCVE-2026-782349.9A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespaceCVE-2026-782368.8An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over CrossCVE-2026-782377.8Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, resulting in persistent