CVE-2026-78222 Overview
A vulnerability in NGINX JavaScript (njs) allows a malformed HTTP response received by ngx.fetch() to crash an NGINX worker process. The crash occurs when trusted JavaScript reads the Response.statusText property from the malformed response. Exploitation requires an attacker to control or influence the fetched HTTP response, making upstream servers or proxied endpoints the primary attack surface. The flaw is classified as [CWE-476] NULL Pointer Dereference. Successful exploitation causes a denial-of-service condition on the data plane. F5 confirms there is no control plane exposure.
Critical Impact
Remote attackers who influence responses returned to ngx.fetch() can repeatedly crash NGINX worker processes, degrading availability of proxied services.
Affected Products
- NGINX with the NGINX JavaScript (njs) module enabled
- Deployments that invoke ngx.fetch() from njs code
- Configurations that read Response.statusText on fetched responses
Discovery Timeline
- 2026-09-02 - CVE-2026-78222 published to the National Vulnerability Database
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-78222
Vulnerability Analysis
The vulnerability resides in the NGINX JavaScript (njs) module's HTTP client implementation. The ngx.fetch() API allows njs scripts to issue HTTP requests to upstream servers and consume their responses. When njs parses a malformed HTTP response, the internal representation of the status text is not properly initialized. Reading the Response.statusText property from JavaScript then dereferences a null pointer inside the NGINX worker. The worker process terminates, dropping active connections handled by that worker. NGINX typically respawns workers, but an attacker able to repeatedly return malformed responses can sustain a denial-of-service condition against the data plane.
Root Cause
The root cause is a NULL pointer dereference [CWE-476] in the njs response-handling code path that populates the statusText field. Malformed HTTP responses bypass the code path that assigns a valid string, leaving the field unset. Subsequent access from JavaScript triggers the dereference.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker must control or influence the HTTP response returned to an ngx.fetch() call. This is realistic when NGINX fetches content from an attacker-controlled origin, a compromised upstream, or an endpoint reachable through DNS or routing manipulation. Any njs code path that reads Response.statusText on the fetched response completes the exploitation.
No verified public exploit code is available. Refer to the F5 Security Article K000162603 for authoritative technical details.
Detection Methods for CVE-2026-78222
Indicators of Compromise
- Repeated NGINX worker process crashes recorded in error.log with signal 11 (SIGSEGV) entries
- Worker respawn events correlated with outbound ngx.fetch() requests to specific upstream hosts
- Elevated 502 or 504 responses served to clients during njs-driven upstream fetches
Detection Strategies
- Monitor NGINX error logs for segmentation faults tied to njs execution frames
- Correlate worker termination events with the upstream hostnames referenced by ngx.fetch() calls
- Inspect proxied response traffic for malformed HTTP status lines returned to NGINX from upstreams
Monitoring Recommendations
- Alert on abnormal rates of NGINX worker restarts using process supervision or system telemetry
- Track outbound requests from NGINX to non-approved destinations that could serve crafted responses
- Baseline the frequency of ngx.fetch() failures and flag deviations that coincide with availability drops
How to Mitigate CVE-2026-78222
Immediate Actions Required
- Inventory all NGINX deployments running the njs module and identify configurations that call ngx.fetch()
- Apply the patched NGINX JavaScript release referenced in F5 Security Article K000162603
- Restrict ngx.fetch() destinations to trusted, authenticated upstreams under organizational control
- Audit njs scripts for reads of Response.statusText and remove or guard non-essential accesses
Patch Information
F5 has issued guidance in F5 Security Article K000162603. Software versions that have reached End of Technical Support (EoTS) are not evaluated by the vendor and should be upgraded to a supported release that contains the fix.
Workarounds
- Disable or remove njs code paths that invoke ngx.fetch() until patches are applied
- Avoid reading Response.statusText in njs; rely on the numeric Response.status code instead
- Constrain outbound egress from NGINX workers with firewall rules that permit only vetted upstream hosts
- Terminate and validate upstream responses through an intermediate proxy that enforces HTTP conformance
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
