Summary
CVE-2026-18329 is an authentication/authorization bypass vulnerability (CWE-636, "Not Failing Securely") affecting the ngx_http_js_module in NGINX JavaScript (njs), when used with the QuickJS (qjs) engine. When an unhandled exception occurs during asynchronous processing of a js_access handler, the access-control phase can fail open instead of denying the request, allowing unauthenticated attackers to bypass access controls. The flaw carries a CVSS v3.1 base score of 8.2 (High) and was publicly disclosed on August 19, 2026, with the CVE published September 2, 2026.
Technical details
- Root cause: The
js_accessphase handler, when invoked asynchronously (e.g., during operations that read the request body), does not guarantee that an exception thrown before an explicit "deny" decision results in the request being blocked. Under certain error conditions the module fails open rather than closed. - Trigger conditions: A
js_accessdirective configured to run custom njs/qjs access-control logic that performs asynchronous operations (such as reading the request body) and can throw an exception before returning an explicit deny. - Attack vector: Network — an unauthenticated remote attacker sends a specially crafted HTTP request designed to trigger an exception in the access-control JavaScript logic during its asynchronous execution.
- Impact: Successful exploitation causes the access-control check to fail open, allowing the attacker to bypass authentication/authorization enforced by the
js_accesshandler and reach protected resources or endpoints without proper authorization.
Affected software
- F5 NGINX JavaScript (njs),
ngx_http_js_module— versions 0.9.9 and 1.0.0 (all versions prior to 1.0.1) - Affects deployments where
js_accessis configured with asynchronous access-control logic (e.g., request body inspection) in the njs/qjs runtime
Severity
- CVSS v3.1 Base Score: 8.2 (High)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Mitigation and recommended actions
- Immediate: Upgrade
ngx_http_js_module/ NGINX JavaScript (njs) to version 1.0.1 or later, which corrects the fail-open behavior in thejs_accesshandler’s asynchronous exception path. - If immediate patching is not possible:
- Review any custom
js_accesshandlers for asynchronous operations (e.g., request body access) and ensure all code paths — including exception/error paths — explicitly deny access rather than relying on implicit default behavior. - Where feasible, avoid performing asynchronous operations inside
js_accesshandlers, or wrap them in explicit try/catch logic that defaults to denial on any error. - Apply additional network-layer or upstream authentication/authorization controls as a compensating measure until the module is patched.
- Monitor logs for anomalous requests that may be attempting to trigger exceptions in access-control logic.
- Review any custom

