# CVE-2026-18329: NGINX JavaScript access control bypass in js_access handler

Source: https://junglewise.ai/threats/cve-2026-18329-nginx-javascript-access-control-bypass-in-js-access-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-18329 · Severity: high · CVSS 8.2 · Published 2026-09-02

NGINX's JavaScript engine (njs) has a flaw in the js_access handler that can allow unauthorized users to bypass access controls. When an error occurs during asynchronous access validation, the system may incorrectly allow requests that should be blocked, giving attackers access to protected resources without proper authentication or authorization.

Vendors: [NGINX](https://junglewise.ai/threats/vendors/nginx).

## Quick answers

**Is CVE-2026-18329 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18329 being exploited in the wild.

**How severe is CVE-2026-18329?** High severity, with a CVSS score of 8.2, published 2 September 2026.

**Which products and versions are affected?** NGINX JavaScript Engine (njs) <UNKNOWN>.

**Is there a fix for CVE-2026-18329?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-18329 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-18329?** Check whether you run NGINX JavaScript Engine (njs) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication/authorization bypass in the NGINX njs engine's js_access handler when processing asynchronous request body operations. The root cause is improper exception handling during asynchronous access-control evaluation; if an exception is thrown before an explicit access denial is returned, the request fails open and proceeds rather than being denied. An unauthenticated attacker can trigger this by sending a crafted HTTP request that induces an error in the access validation logic. This is a data plane issue with no control plane exposure. A patch is expected from NGINX/F5.

## Affected products

- NGINX JavaScript Engine (njs) <UNKNOWN>

## Timeline

- 2026-09-02: disclosed

## References

- [https://my.f5.com/manage/s/article/K000162599](https://my.f5.com/manage/s/article/K000162599)