CVE-2021-46461: Nginx Njs Buffer Overflow Vulnerability

CVE-2021-46461 Overview

CVE-2021-46461 is an out-of-bounds array access vulnerability in njs through version 0.7.0, the JavaScript scripting language engine used in NGINX. The flaw resides in the njs_vmcode_typeof function within /src/njs_vmcode.c. An attacker can trigger out-of-bounds memory access by submitting crafted script input to an NGINX instance running njs. The vulnerability is classified as [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer) and is reachable over the network without authentication or user interaction.

Critical Impact
Remote attackers can trigger out-of-bounds memory access in njs through 0.7.0, potentially impacting confidentiality, integrity, and availability of NGINX deployments that load the njs module.

Affected Products

nginx njs through version 0.7.0
NGINX deployments using the njs scripting module
NetApp products bundling affected njs versions (per NetApp Security Advisory NTAP-20220303-0007)

Discovery Timeline

2022-02-14 - CVE-2021-46461 published to the National Vulnerability Database (NVD)
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-46461

Vulnerability Analysis

The vulnerability is an out-of-bounds array access in the njs virtual machine bytecode interpreter. njs is the JavaScript scripting engine embedded into NGINX to extend request handling with scripts. The defect lives inside njs_vmcode_typeof, the handler for the JavaScript typeof operator in the njs VM dispatch logic. When the interpreter processes a crafted bytecode operand, it dereferences memory outside the bounds of the expected operand array. The repository commit d457c9545e7e71ebb5c0479eb16b9d33175855e2 corrects the bounds handling within this code path. Successful exploitation can corrupt process memory, leak adjacent data, or crash the NGINX worker process. Because njs scripts execute inside the NGINX worker, any memory safety failure inside the engine extends to the web-facing process.

Root Cause

The root cause is improper validation of operand indices passed to njs_vmcode_typeof in /src/njs_vmcode.c. The function reads from a memory region without confirming that the computed offset stays within the bounds of the backing buffer. This classifies as [CWE-119]. See the upstream njs commit d457c95 and GitHub njs Issue #450 for technical details.

Attack Vector

The attack vector is network-based. An attacker supplies crafted JavaScript that NGINX evaluates through the njs module. In typical deployments, this requires the operator to load attacker-controlled or attacker-influenced njs scripts. The vulnerability requires no privileges and no user interaction once the affected script path is reachable. The vulnerability mechanism is described in prose only because no verified public exploit code is associated with this CVE.

// No verified public exploit code is available for CVE-2021-46461.
// Refer to the upstream commit d457c9545e7e71ebb5c0479eb16b9d33175855e2
// and njs GitHub issue #450 for the bounds-check correction in
// njs_vmcode_typeof within /src/njs_vmcode.c.

Detection Methods for CVE-2021-46461

Indicators of Compromise

Unexpected crashes or segmentation faults in NGINX worker processes that load the njs module
core dumps referencing njs_vmcode_typeof or addresses inside /src/njs_vmcode.c
Repeated 5xx responses from endpoints handled by njs scripts following anomalous request patterns

Detection Strategies

Inventory NGINX hosts and identify any instance loading the njs module at or below version 0.7.0
Review NGINX configuration for js_import, js_content, js_set, and js_periodic directives that expose njs script execution to network input
Correlate worker process crashes with request logs to identify input patterns exercising typeof on unexpected operand types

Monitoring Recommendations

Forward NGINX error_log entries and worker exit signals to a centralized logging or SIEM platform for alerting on abnormal termination
Track NGINX worker restart frequency as a baseline signal; spikes can indicate exploitation attempts against memory safety bugs in njs
Monitor outbound connections from NGINX worker processes for deviations that suggest post-exploitation activity

How to Mitigate CVE-2021-46461

Immediate Actions Required

Upgrade njs to a version that includes commit d457c9545e7e71ebb5c0479eb16b9d33175855e2 (post-0.7.0 fixed release)
Audit NGINX configuration to confirm njs scripts only process trusted input paths
Apply vendor-provided updates for bundled distributions, including those covered by NetApp Security Advisory NTAP-20220303-0007

Patch Information

The upstream fix is committed in the nginx/njs repository. See GitHub njs commit d457c95 for the corrected bounds handling in njs_vmcode_typeof. Rebuild NGINX against a patched njs release or install vendor packages that ship the fixed version.

Workarounds

Disable the njs module on NGINX servers that do not require JavaScript scripting until a patched release is deployed
Remove or restrict js_import and js_content directives that evaluate scripts against untrusted request data
Place a reverse proxy or web application firewall in front of njs-enabled endpoints to filter malformed input while patching is in progress

bash

# Verify the installed njs module version on an NGINX host
nginx -V 2>&1 | tr ' ' '\n' | grep -i njs

# Inspect loaded modules and njs directives in active configuration
nginx -T 2>/dev/null | grep -E 'load_module.*njs|js_(import|content|set|periodic)'