CVE-2026-101025 NGINX ngx_http_js_module vulnerability
An unauthenticated attacker can cause denial of service in NGINX by sending malformed XML requests that trigger memory leaks in the njs engine.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-101025?
CVE-2026-101025 is a medium-severity denial of service vulnerability in F5 NGINX JavaScript, published on 14 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Description
NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests with malformed XML and can cause unbounded memory growth in long-lived NGINX worker processes.
Impact
This vulnerability may allow remote attackers to send requests that trigger repeated parsing of malformed XML and may lead to NGINX worker termination or denial of service. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Weakness: CWE-401
Which versions are affected by CVE-2026-101025?
How do I fix CVE-2026-101025?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-101025 being exploited?
There is no known exploitation of CVE-2026-101025 in the wild and no public exploit code.
Sources
Also known as AZL-108455, BELL-CVE-2026-101025, DEBIAN-CVE-2026-101025, GHSA-4jj4-r79f-9v3x, UBUNTU-CVE-2026-101025.