PT-2022-17096 · Nginx · Njs

Anonym0Us1337 · Published 2022-02-14 · Updated 2026-04-21 · CVE-2022-25139

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions njs versions through 0.7.0

Description A heap use-after-free issue was discovered in njs await fulfilled, affecting njs used in NGINX.

Recommendations For versions through 0.7.0, consider disabling the njs await fulfilled function until a patch is available.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CLEANSTART-2026-AF45008

CLEANSTART-2026-BA37192

CLEANSTART-2026-MQ02912

CLEANSTART-2026-XB16901

CLEANSTART-2026-ZN32454

CLEANSTART-2026-ZT77083

CVE-2022-25139

Affected Products

Njs

References · 63

• 🔥 https://github.com/nginx/njs/issues/451 · Exploit
• https://github.com/nginx/njs/commit/6a07c2156a07ef307b6dcf3c2ca8571a5f1af7a6 · Patch
• https://osv.dev/vulnerability/CLEANSTART-2026-XB16901 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9516 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-44487 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-35200 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-16845 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-ZN32454 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7347 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-46463 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-23017 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-41742 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-AF45008 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-23419 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-34161 · Security Note