Skip to content
Threat Feed
Subscribe

Product

QuickJS

2 briefs RSS
high advisory

Out-of-Bounds Write in NGINX JavaScript (njs) XML Module

CVE-2026-78689 allows remote unauthenticated attackers to trigger an out-of-bounds heap write in the NGINX JavaScript (njs) and QuickJS (qjs) XML module via crafted namespace prefix lists.

njs +2 vulnerability denial-of-service cve-2026-78689
1c
high advisory

Authentication Bypass in NGINX JavaScript and QuickJS Engines

An authentication bypass flaw in NGINX JavaScript (njs) and QuickJS (qjs) engines allows unauthenticated attackers to trigger a fail-open state in access control logic, potentially granting unauthorized access to protected resources.

NGINX JavaScript +1
1t 1c