Vulnerability · Published Oct 14, 2026 · Assigned by f5

CVE-2026-101025NGINX ngx_http_js_module vulnerability

Medium 5.3

In plain English

A medium-severity memory leak in NGINX JavaScript from F5. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 75.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests with malformed XML and can cause unbounded memory growth in long-lived NGINX worker processes. Impact This vulnerability may allow remote attackers to send requests that trigger repeated parsing of malformed XML and may lead to NGINX worker termination or denial of service. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	libnginx-mod-js	no fix listed	DEBIAN-CVE-2026-101025
Debian:13	libnginx-mod-js	no fix listed	DEBIAN-CVE-2026-101025
Debian:14	libnginx-mod-js	1.0.2-1	DEBIAN-CVE-2026-101025
Ubuntu:24.04:LTS	libnginx-mod-js	no fix listed	UBUNTU-CVE-2026-101025
Ubuntu:26.10	libnginx-mod-js	no fix listed	UBUNTU-CVE-2026-101025

Affected products (as reported)

Vendor	Product	Versions
F5	NGINX JavaScript	0.7.10 – before 1.0.2

Weakness: CWE-401 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

https://my.f5.com/manage/s/article/K000162614 vendor-advisory