CVE-2026-78222

CVE-2026-78222 is a null-pointer-dereference flaw (CWE-476) in NGINX JavaScript (njs) that crashes an NGINX worker when trusted JavaScript reads the Response.statusText property of a malformed HTTP response obtained via ngx.fetch(). To trigger it, an attacker must control or influence the HTTP response the njs code fetches (for example an upstream, backend, or third-party service reached by ngx.fetch()) and supply a malformed response. The attacker gains a remote denial of service: the crashed worker drops the connections it is handling, and repeated triggering can continuously disrupt the NGINX instance; there is no confidentiality or integrity impact, and this is a data-plane issue with no control-plane exposure. Only deployments running njs whose configurations call ngx.fetch() against attacker-influenceable responses are affected; NGINX deployments that do not use njs are not. There is no public proof-of-concept, no CISA KEV listing, and no known in-the-wild exploitation; EPSS currently assigns a 0.4% probability of exploitation within 30 days.

What to do: Upgrade NGINX JavaScript (njs) and the bundled NGINX njs module to the fixed version listed in the F5 security advisory, as affected version ranges are not specified in the data available here. In the meantime, audit njs code for ngx.fetch() calls and remove or guard reads of Response.statusText where the fetched response may be attacker-influenced, or restrict fetches to trusted upstreams. If you run an NGINX release that has reached End of Technical Support, note it was not evaluated for this flaw and plan a move to a supported version.