PT-2022-12721 · Nginx · Njs

Afang5472 + 2 · Published 2022-02-14 · Updated 2026-04-21 · CVE-2021-46463

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions njs versions through 0.7.1

Description A control flow hijack was discovered in njs, caused by a Type Confusion vulnerability in the njs promise perform then() function. This issue affects njs used in NGINX.

Recommendations For versions through 0.7.1, consider disabling the njs promise perform then() function as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

CLEANSTART-2026-AF45008

CLEANSTART-2026-BA37192

CLEANSTART-2026-MQ02912

CLEANSTART-2026-XB16901

CLEANSTART-2026-ZN32454

CLEANSTART-2026-ZT77083

CVE-2021-46463

Affected Products

Njs

References · 63

• 🔥 https://github.com/nginx/njs/issues/447 · Exploit
• https://github.com/nginx/njs/commit/6a40a85ff239497c6458c7dbef18f6a2736fe992 · Patch
• https://osv.dev/vulnerability/CVE-2021-46463 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-XB16901 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9516 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-44487 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-35200 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-16845 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-ZN32454 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7347 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-46463 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-23017 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-41742 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-AF45008 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-23419 · Security Note