Loading story…
The nginx project released njs 1.0.1, updating its JavaScript extension for nginx HTTP processing. The release remediates three vulnerabilities: CVE-2026-78689, CVE-2026-18329, and CVE-2026-78222, affecting the xml.exclusiveC14n, js_access, and ngx.fetch functionality.
The update was announced alongside nginx 1.31.5, a mainline development release. Organizations using njs should review their exposure to the affected APIs and upgrade to njs 1.0.1; nginx 1.30.x remains the maintained stable branch for serious bug and security fixes, while the 1.31.x line is expected to form the future nginx 1.32 stable release.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
njs 1.0.1 was released for extending nginx HTTP processing with JavaScript support. It fixes CVE-2026-78689 in xml.exclusiveC14n, CVE-2026-18329 involving js_access, and CVE-2026-78222 involving ngx.fetch.
nginx 1.31.5 was released as a mainline development version. The 1.30.x branch remains the stable branch for serious bug and security fixes, while 1.31.x is expected to form the future nginx 1.32 stable release.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
NGINX released versions **1.31.3** and **1.30.4** to fix three security vulnerabilities affecting both **NGINX Open Source** and **F5 NGINX Plus**. The most severe issue, **CVE-2026-42533**, affects configurations using the `map` directive with regex matching in unsafe expression patterns and can be triggered by a crafted HTTP request from an unauthenticated attacker. F5 said the flaw can cause a heap buffer overflow in the worker process, leading to denial of service through worker restarts and, in environments where protections such as ASLR are disabled or bypassed, possible remote code execution. The issue is limited to the data plane, with no reported control plane exposure. The updates also address **CVE-2026-60005** in `ngx_http_slice_module`, where unauthenticated requests or background cache updates can trigger uninitialized memory access when the `slice` directive and unnamed regex captures are used, causing limited memory disclosure or worker crashes. A third flaw, **CVE-2026-56434**, affects `ngx_http_ssi_module` when **SSI**, `proxy_pass`, and `proxy_buffering off` are combined, allowing an attacker with man-in-the-middle control over upstream responses to trigger a heap buffer over-read that may restart the worker process or enable limited memory modification. The release additionally includes hardening and functional changes, including XML external entity controls for `ngx_http_xslt_filter_module`, new socket buffer directives, and HTTP/2 buffer handling improvements.
Aug 15, 2026
Node.js released security updates for all active release lines, shipping **v22.23.2**, **v24.18.1**, and **v26.5.1** to fix 11 vulnerabilities affecting the 22.x, 24.x, and 26.x branches. The most serious issues include two high-severity HTTP/2 flaws, `CVE-2026-56846` and `CVE-2026-56848`, which could let attackers trigger denial of service through memory exhaustion or process crashes, and `CVE-2026-58043`, a high-severity bypass in the Permission Model that could allow applications started with `--permission` to access filesystem paths outside the intended allowlist. The update also addresses weaknesses involving HTTPS connection reuse, mTLS identity reuse, hostname verification bypass, DNS handling, SQLite, zlib APIs, and an HTTP parser issue that could enable request smuggling in Node.js-based forwarding proxies. An oss-sec follow-up noted that an earlier announcement linked to the wrong Node.js blog entry and should instead reference the July security releases page, while maintainers emphasized that unsupported Node.js versions remain exposed and should be retired or upgraded immediately.
Jul 30, 2026
Node.js released security updates for supported 20.x, 22.x, 24.x, and 25.x branches to fix **two high-severity**, **five medium-severity**, and **two low-severity** vulnerabilities, with patched versions issued as `v20.20.2`, `v22.22.2`, `v24.14.1`, and `v25.8.2`. The most serious bug, `CVE-2026-21637`, was an incomplete fix in TLS `SNICallback` handling that could be triggered remotely to cause an uncaught exception and crash affected processes. A second high-severity issue, `CVE-2026-21710`, allowed specially crafted HTTP requests using a `__proto__` header name to trigger a denial of service when applications accessed `req.headersDistinct`. The release also addressed Permission Model bypasses, a native crash in URL formatting, a timing side-channel in HMAC verification, an HTTP/2 flow-control memory leak that could lead to memory exhaustion, and a V8 **HashDoS** weakness; Node.js also updated the `undici` dependency on 22.x, 24.x, and 25.x to remediate public vulnerabilities. Debian published a corresponding `nodejs` security update, and the Canadian Centre for Cyber Security urged administrators to review vendor guidance and apply the patched releases, with internet-facing TLS servers identified as the highest-priority systems for remediation.
Jul 29, 2026