{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/quickjs/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:nginx:njs:*:*:*:*:*:*:*:*","cpe:2.3:a:quickjs:quickjs:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-78689"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["njs","QuickJS","nginx-saml"],"_cs_severities":["high"],"_cs_tags":["vulnerability","denial-of-service","cve-2026-78689"],"_cs_type":"advisory","_cs_vendors":["NGINX","Fabrice Bellard"],"content_html":"\u003cp\u003eCVE-2026-78689 is an out-of-bounds heap write vulnerability affecting the XML module of the NGINX JavaScript (njs) engine and the QuickJS (qjs) engine. The flaw is located in the xml.exclusiveC14n() method, which fails to safely process an XML namespace prefix list provided by an external source. An unauthenticated remote attacker can exploit this by passing a crafted prefix list to the method.\u003c/p\u003e\n\u003cp\u003eWhen using the njs engine, the out-of-bounds write corrupts adjacent heap objects, leading to an immediate crash of the NGINX worker process. When using the QuickJS engine, the vulnerability causes memory leakage on every request, resulting in memory exhaustion. The nginx-saml reference implementation is specifically vulnerable during SAML signature verification, as it processes the InclusiveNamespaces/@PrefixList from untrusted SAML messages before verifying the digital signature. Consequently, attackers can trigger the crash or memory growth using crafted SAML Response, Assertion, LogoutRequest, or LogoutResponse packets. While remote code execution has not been observed, it remains a theoretical possibility depending on specific platform memory layout.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability impacts the availability of NGINX instances processing XML or SAML data. Successful exploitation leads to denial of service through repeatable worker process restarts (njs engine) or rapid worker memory growth (QuickJS engine). Because the flaw triggers before SAML signature validation, attackers do not require valid credentials or legitimate SAML tokens to impact the target service.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all instances using the \u003ccode\u003enginx-saml\u003c/code\u003e reference implementation and upgrade to the patched version once available.\u003c/li\u003e\n\u003cli\u003eReview NGINX configurations for usages of \u003ccode\u003exml.exclusiveC14n()\u003c/code\u003e that process untrusted XML input and implement rigorous input validation for the \u003ccode\u003ePrefixList\u003c/code\u003e attribute.\u003c/li\u003e\n\u003cli\u003eMonitor NGINX error logs for recurring \u0026quot;worker process exited with signal\u0026quot; events, which may indicate crash-based denial of service attempts.\u003c/li\u003e\n\u003cli\u003eMonitor memory usage of NGINX worker processes to detect memory exhaustion patterns indicative of QuickJS exploitation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-02T17:16:10Z","date_published":"2026-09-02T17:16:10Z","id":"https://feed.craftedsignal.io/briefs/2026-09-nginx-njs-xml-vuln/","summary":"CVE-2026-78689 allows remote unauthenticated attackers to trigger an out-of-bounds heap write in the NGINX JavaScript (njs) and QuickJS (qjs) XML module via crafted namespace prefix lists.","title":"Out-of-Bounds Write in NGINX JavaScript (njs) XML Module","url":"https://feed.craftedsignal.io/briefs/2026-09-nginx-njs-xml-vuln/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:f5:nginx_javascript:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.2,"id":"CVE-2026-18329"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["NGINX JavaScript","QuickJS"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["F5"],"content_html":"\u003cp\u003eThe NGINX JavaScript (njs) and QuickJS (qjs) engines contain a vulnerability involving the js_access handler during asynchronous request body processing. When an exception occurs during the asynchronous access-control evaluation phase - specifically before the handler can return an explicit access denial - the engine may fail open. This misconfiguration in the access validation logic permits the request to proceed to downstream resources despite failing security checks.\u003c/p\u003e\n\u003cp\u003eAn unauthenticated remote attacker can exploit this condition by sending a crafted HTTP request designed to trigger an error within the access-control JavaScript logic. This results in an authorization bypass, potentially allowing access to protected endpoints that should have been restricted. This vulnerability exists within the data plane, impacting any application relying on the njs or qjs access control handlers for security enforcement.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to bypass security controls defined within the js_access handler. This can result in unauthorized access to sensitive application data or protected administrative functions. As this is a data plane issue affecting request processing, it does not involve exposure of the server control plane but directly undermines the security posture of the web application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all instances of NGINX utilizing the \u003ccode\u003ejs_access\u003c/code\u003e handler for security controls.\u003c/li\u003e\n\u003cli\u003eAudit JavaScript access control logic to ensure that error conditions do not result in a default-allow state.\u003c/li\u003e\n\u003cli\u003eMonitor web server error logs for unexpected exceptions occurring within JavaScript access handlers, which may indicate exploitation attempts.\u003c/li\u003e\n\u003cli\u003eApply patches provided by the software vendor once available for NGINX and affected distributions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-02T17:15:05Z","date_published":"2026-09-02T17:15:05Z","id":"https://feed.craftedsignal.io/briefs/2026-09-nginx-auth-bypass/","summary":"An authentication bypass flaw in NGINX JavaScript (njs) and QuickJS (qjs) engines allows unauthenticated attackers to trigger a fail-open state in access control logic, potentially granting unauthorized access to protected resources.","title":"Authentication Bypass in NGINX JavaScript and QuickJS Engines","url":"https://feed.craftedsignal.io/briefs/2026-09-nginx-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - QuickJS","version":"https://jsonfeed.org/version/1.1"}