CVE-2026-78222: CWE-476 NULL Pointer Dereference in F5 NGINX JavaScript

This vulnerability (CWE-476 NULL Pointer Dereference) occurs in NGINX JavaScript's ngx.fetch() function when it processes a malformed HTTP response. Specifically, when trusted JavaScript reads the Response.statusText property from such a response, it can cause a NULL pointer dereference leading to a crash of the NGINX worker process. Successful exploitation requires an attacker to control or influence the HTTP response fetched by ngx.fetch(). The impact is limited to causing a denial-of-service on the affected NGINX system's data plane. No control plane or broader system compromise is indicated.

Remote attackers who can control or influence HTTP responses fetched by NGINX JavaScript can cause a denial-of-service by crashing NGINX worker processes. This disrupts service availability but does not affect confidentiality or integrity. The issue is confined to the data plane with no control plane exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit exposure by restricting or validating external HTTP responses processed by ngx.fetch() where possible.