CVE-2026-78222highCWE-476

CVE-2026-78222: falha de alta gravidade em F5 NGINX JavaScript

NGINX ngx_http_js_module vulnerability

Publicada em

Seguir esta CVE+ Monitorar NGINX JavaScript+ Monitorar libnginx-mod-js

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.6%
A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
F5 · NGINX JavaScript
CVEs relacionadas — F5 NGINX JavaScript

No mesmo produto, das mais perigosas para as menos.

CVE-2026-8711CRITICALNGINX JavaScript vulnerabilityEPSS 9.7%CVE-2026-78689CRITICALNGINX ngx_http_js_module vulnerablilityEPSS 0.8%CVE-2026-18329HIGHNGINX ngx_http_js_module vulnerabilityEPSS 0.6%CVE-2026-101025MEDIUMNGINX ngx_http_js_module vulnerabilityEPSS 0.3%CVE-2026-101019HIGHNGINX ngx_http_js_module vulnerabilityEPSS 0.2%