CVE-2026-18329: CWE-636 in F5 NGINX JavaScript

The vulnerability in NGINX JavaScript (njs) and QuickJS (qjs) engines arises when a js_access handler asynchronously processes request bodies and an exception occurs before an explicit access denial is returned. This can cause the js_access phase to fail open, allowing crafted HTTP requests from unauthenticated attackers to bypass access controls. This results in authentication or authorization bypass, granting unauthorized access to protected resources. The vulnerability is identified as CWE-636 (Use of Externally-Controlled Reference to a Resource in a Security Decision). It affects versions 0.9.9 and 1.0.0 of the product. There is no indication of control plane exposure or known exploits in the wild. The CVSS v3.1 score is 8.2, indicating high severity.

Remote attackers can bypass js_access controls, leading to unauthorized access to protected resources. The vulnerability affects only the data plane and does not expose the control plane. This can result in partial confidentiality loss (high impact on confidentiality), limited integrity impact, and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Users should monitor for vendor updates and advisories regarding patches or workarounds. Until a fix is available, carefully review and test js_access handlers for error handling during asynchronous request body processing to minimize risk.