CVE-2026-78689— F5 NGINX JavaScript 缓冲区错误漏洞
一分钟漏洞结论
影响对象
F5 NGINX JavaScript
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
F5 NGINX JavaScript是美国F5公司的一个嵌入式JavaScript脚本语言。 F5 NGINX JavaScript 0.7.10版本至1.0.1之前版本存在缓冲区错误漏洞，该漏洞源于XML模块的命名空间前缀列表解析器在处理特制的XML命名空间前缀列表时存在越界写入，可能导致拒绝服务或执行任意代码。
影响版本矩阵 1
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| F5 | NGINX JavaScript | 0.7.10< 1.0.1 |
affected |
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-78689 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
NGINX ngx_http_js_module vulnerablility
来源: CVE Program / CVE List V5
Vulnerability Description
Description
NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n() method. An unauthenticated remote attacker can trigger it when an affected NGINX configuration passes an externally controlled XML namespace prefix list to that method. Both the njs and the QuickJS (qjs) engines are affected. A crafted prefix list causes an out-of-bounds write past the end of a heap allocation. With the njs engine, which is the engine used when the js_engine directive is absent, this corrupts adjacent objects and crashes the NGINX worker. With the QuickJS engine, the same call additionally leaks the prefix list on every invocation, causing worker memory to grow across requests. The official nginxinc/nginx-saml reference implementation is affected during SAML signature verification. It reads InclusiveNamespaces/@PrefixList from an untrusted SAML message and passes it to xml.exclusiveC14n() before the signature has been verified, so a valid SAML signature is not required. A crafted SAML Response, Assertion, LogoutRequest, or LogoutResponse is sufficient. Code execution has not been demonstrated and cannot be ruled out for all platforms, as the effect of the out-of-bounds write depends on conditions beyond the attacker's control.
Impact
This vulnerability allows remote attackers to cause a denial of service on the NGINX system, either through repeatable worker restarts or through worker memory growth or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
堆缓冲区溢出
来源: CVE Program / CVE List V5
Vulnerability Title
F5 NGINX JavaScript 缓冲区错误漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
F5 NGINX JavaScript是美国F5公司的一个嵌入式JavaScript脚本语言。 F5 NGINX JavaScript 0.7.10版本至1.0.1之前版本存在缓冲区错误漏洞，该漏洞源于XML模块的命名空间前缀列表解析器在处理特制的XML命名空间前缀列表时存在越界写入，可能导致拒绝服务或执行任意代码。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| F5 | NGINX JavaScript | 0.7.10 ~ 1.0.1 | - |
|
二、漏洞 CVE-2026-78689 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-78689 的情报信息
请登录查看更多情报信息。
CVE-2026-78689 厂商安全公告 (1)
-
🔗 my.f5.com vendor-advisory
同批安全公告 · F5 · 2026-09-02 · 共 7 条
| CVE-2026-66842 | 8.8 HIGH | F5 BIG-IP 服务端请求伪造漏洞 |
| CVE-2026-77180 | 8.3 HIGH | F5 NGINX Ingress Controller 输入验证错误漏洞 |
| CVE-2026-18329 | 8.2 HIGH | F5 NGINX JavaScript 异常处理不当漏洞 |
| CVE-2026-66362 | 8.1 HIGH | F5 NGINX Gateway Fabric 输入验证错误漏洞 |
| CVE-2026-78222 | 7.5 HIGH | F5 NGINX JavaScript 异常处理不当漏洞 |
| CVE-2026-63020 | 3.1 LOW | F5 BIG-IP 处理逻辑错误漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-78689
暂无评论