PT-2022-12719 · Nginx · Njs

Anonym0Us1337 · Published 2022-02-14 · Updated 2026-04-21 · CVE-2021-46461

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions njs versions through 0.7.0

Description The issue is related to an out-of-bounds array access via njs vmcode typeof in /src/njs vmcode.c. This affects njs, which is used in NGINX.

Recommendations For versions through 0.7.0, consider updating to a version that contains a fix for this issue, as no specific workaround is provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CLEANSTART-2026-AF45008

CLEANSTART-2026-BA37192

CLEANSTART-2026-MQ02912

CLEANSTART-2026-XB16901

CLEANSTART-2026-ZN32454

CLEANSTART-2026-ZT77083

CVE-2021-46461

Affected Products

Njs

References · 62

• 🔥 https://github.com/nginx/njs/issues/450 · Exploit
• https://github.com/nginx/njs/commit/d457c9545e7e71ebb5c0479eb16b9d33175855e2 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-XB16901 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9516 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-44487 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-35200 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-16845 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-ZN32454 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7347 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-46463 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-23017 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-41742 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-AF45008 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46461 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-23419 · Security Note