Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-101025: Nginx JavaScript module can run out of memory
CVE-2026-101025 · published 21 days ago
Summary
The JavaScript engine used in Nginx (provided by f5, Debian, Canonical and BellSoft packages) can leak memory when it tries to read malformed XML. An attacker can send specially crafted XML that makes the Nginx worker process consume more and more memory, eventually causing it to stop responding. Upgrade to a version that includes the fix or disable the JavaScript module until you can apply the update.
What to do
- Update debian libnginx-mod-js to version 1.0.2-1.
- Update f5 nginx javascript to version 1.0.2 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | f5 | nginx javascript | < 1.0.2 |
| Debian:12 | debian | libnginx-mod-js | All versions |
| Ubuntu:24.04:LTS | canonical | libnginx-mod-js | All versions |
| Alpaquita:23 | bellsoft | nginx | >= 1.22.1-r0 |
| Alpaquita:25 | bellsoft | nginx | >= 1.28.0-r3 |
| Debian:14 | debian | libnginx-mod-js |
< 1.0.2-1 Fix: upgrade to 1.0.2-1
|
Original advisory text
BELL-CVE-2026-101025
Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests with malformed XML and can cause unbounded memory growth in long-lived NGINX worker processes. Impact This vulnerability may allow remote attackers to send requests that trigger repeated parsing of malformed XML and may lead to NGINX worker termination or denial of service. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
References
- https://security-tracker.debian.org/tracker/CVE-2026-101025 Vendor Advisory
- https://my.f5.com/manage/s/article/K000162614 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-101025 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-101025 Third Party Advisory
- https://docs.bell-sw.com/security/cves/CVE-2026-101025 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
7.8
High
Type
CWE-401Memory Leak
Timeline
Published14 Oct 2026
Updated31 Oct 2026
First seen14 Oct 2026
Sources
CVE-2026-101025 · NVD
CVE-2026-101025 · MITRE
DEBIAN-CVE-2026-101025 · OSV
UBUNTU-CVE-2026-101025 · OSV
BELL-CVE-2026-101025 · OSV
Track software like this
Free during beta