CyberRota Analysis
AI-GeneratedA vulnerability in NGINX JavaScript allows remote attackers to exploit malformed HTTP responses processed by ngx.fetch(), potentially leading to a denial-of-service (DoS) condition by crashing an NGINX worker. Organizations using NGINX with JavaScript should prioritize this issue to mitigate the risk of service disruption, particularly if they handle untrusted HTTP responses.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.