Executive brief
NGINX's JavaScript engine (njs) has a flaw in the js_access handler that can allow unauthorized users to bypass access controls. When an error occurs during asynchronous access validation, the system may incorrectly allow requests that should be blocked, giving attackers access to protected resources without proper authentication or authorization.
Technical details
The vulnerability is an authentication/authorization bypass in the NGINX njs engine's js_access handler when processing asynchronous request body operations. The root cause is improper exception handling during asynchronous access-control evaluation; if an exception is thrown before an explicit access denial is returned, the request fails open and proceeds rather than being denied. An unauthenticated attacker can trigger this by sending a crafted HTTP request that induces an error in the access validation logic. This is a data plane issue with no control plane exposure. A patch is expected from NGINX/F5.
Affected products
- NGINX JavaScript Engine (njs) <UNKNOWN>
Timeline
- 2026-09-02: disclosed