CVE-2026-18329

CVE-2026-18329 is a fail-open error-handling flaw in the NGINX JavaScript (njs) and QuickJS (qjs) engines that can cause access-control failures to fall through to an allow. It is triggered when a js_access handler performs asynchronous request body processing and an exception is thrown during the asynchronous access-control evaluation before an explicit deny is returned, causing the js_access phase to complete as if access were granted. An unauthenticated attacker can send a crafted HTTP request that triggers this error condition and thereby bypass js_access-based authentication or authorization, gaining access to protected resources. Only NGINX deployments running njs or qjs with such js_access handlers are affected, and the issue is confined to the data plane; the control plane is not exposed. No exploitation has been observed to date: EPSS is 0.4% (31st percentile), the flaw is not in CISA KEV, and no public proof-of-concept is known; F5 notes that versions past End of Technical Support were not evaluated.

What to do: Upgrade njs and qjs to the versions listed as fixed in the F5 advisory (exact fixed versions are not included in the data provided). As an interim mitigation, review js_access handlers: avoid asynchronous request-body processing in access checks or ensure every error/exception path returns an explicit deny rather than relying on thrown exceptions. Confirm which NGINX configurations enable njs or qjs and whether any js_access handlers match this pattern, noting that F5 has not evaluated EoTS versions.