CVE-2026-18329 – Authentication/Authorization Bypass – NGINX JavaScript (njs/qjs) ngx_http_js_module

Summary

CVE-2026-18329 is an authentication/authorization bypass vulnerability (CWE-636, "Not Failing Securely") affecting the ngx_http_js_module in NGINX JavaScript (njs), when used with the QuickJS (qjs) engine. When an unhandled exception occurs during asynchronous processing of a js_access handler, the access-control phase can fail open instead of denying the request, allowing unauthenticated attackers to bypass access controls. The flaw carries a CVSS v3.1 base score of 8.2 (High) and was publicly disclosed on August 19, 2026, with the CVE published September 2, 2026.

Technical details

• Root cause: The js_access phase handler, when invoked asynchronously (e.g., during operations that read the request body), does not guarantee that an exception thrown before an explicit "deny" decision results in the request being blocked. Under certain error conditions the module fails open rather than closed.
• Trigger conditions: A js_access directive configured to run custom njs/qjs access-control logic that performs asynchronous operations (such as reading the request body) and can throw an exception before returning an explicit deny.
• Attack vector: Network — an unauthenticated remote attacker sends a specially crafted HTTP request designed to trigger an exception in the access-control JavaScript logic during its asynchronous execution.
• Impact: Successful exploitation causes the access-control check to fail open, allowing the attacker to bypass authentication/authorization enforced by the js_access handler and reach protected resources or endpoints without proper authorization.

Affected software

• F5 NGINX JavaScript (njs), ngx_http_js_module — versions 0.9.9 and 1.0.0 (all versions prior to 1.0.1)
• Affects deployments where js_access is configured with asynchronous access-control logic (e.g., request body inspection) in the njs/qjs runtime

Severity

• CVSS v3.1 Base Score: 8.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Mitigation and recommended actions

• Immediate: Upgrade ngx_http_js_module / NGINX JavaScript (njs) to version 1.0.1 or later, which corrects the fail-open behavior in the js_access handler’s asynchronous exception path.
• If immediate patching is not possible:
  • Review any custom js_access handlers for asynchronous operations (e.g., request body access) and ensure all code paths — including exception/error paths — explicitly deny access rather than relying on implicit default behavior.
  • Where feasible, avoid performing asynchronous operations inside js_access handlers, or wrap them in explicit try/catch logic that defaults to denial on any error.
  • Apply additional network-layer or upstream authentication/authorization controls as a compensating measure until the module is patched.
  • Monitor logs for anomalous requests that may be attempting to trigger exceptions in access-control logic.

References

• CVE-2026-18329 Record (CVE Program)
• F5 Security Advisory K000162599
• NVD – CVE-2026-18329