CVE-2026-18329 NGINX ngx_http_js_module vulnerability
An unauthenticated attacker can bypass js_access controls by triggering an exception during asynchronous body processing, gaining unauthorized access to protected resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-18329?
CVE-2026-18329 is a high-severity authentication bypass vulnerability in F5 NGINX JavaScript, published on 2 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Description
NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request that triggers an error condition in the access validation logic. This may cause the js_access phase to fail open, allowing the request to proceed instead of being denied, resulting in an authentication or authorization bypass and unauthorized access to protected resources.
Impact
This vulnerability may allow remote attackers to bypass js_access controls. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Weakness: CWE-636
Which versions are affected by CVE-2026-18329?
How do I fix CVE-2026-18329?
Apply the vendor's patch.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-18329 being exploited?
There is no known exploitation of CVE-2026-18329 in the wild and no public exploit code.
Sources
Also known as AZL-99303, DEBIAN-CVE-2026-18329, GHSA-jm9r-m8jm-j2hr, UBUNTU-CVE-2026-18329.