njs-1.0.1 has been released with fixes for three security issues:
- Access control bypass in js_access when an asynchronous request body continuation threw an exception or produced an unhandled rejection (CVE-2026-18329). Previously, nginx could continue processing the request as though the
js_accesscheck had succeeded. Affects 0.9.9-1.0.0. Thanks to Ta Duc Thien. - Worker process crash when reading Response.statusText after an upstream server returned a status line with an empty reason phrase (CVE-2026-78222). Affects 0.5.1-1.0.0.
- Heap buffer overflow while parsing namespace prefix lists passed to xml.exclusiveC14n() (CVE-2026-78689). Affects 0.7.10-1.0.0. Thanks to Vladimir, Vulnerability Research Tech Lead @ Cyera, evilgensec.
The release also continues the hardening of the QuickJS engine integration: cyclic references between Fetch, HTTP request, and Stream session objects no longer cause use-after-free, worker aborts, or leaks, and context reuse after internal redirects, with pending jobs left after request teardown, or with partially initialized contexts is now handled correctly. Request and response header handling is validated consistently: names and values of r.headersOut and Fetch Headers, as well as redirect targets passed to r.return(), are rejected before serialization.
Other notable changes:
- btoa() and atob() are now available in the QuickJS engine, with the behavior aligned between both engines
- fixed a stack buffer overflow when exporting RSA keys larger than 4096 bits to JWK in crypto.subtle.exportKey() (thanks to Vaibhav Rajput)
- fixed RSA-OAEP encryption and decryption with SHA-256 and SHA-384 digests in WebCrypto (thanks to @tompsota)
- fixed SharedDict.pop() returning
undefinedfor unexpired entries in shared dictionaries with a timeout (thanks to @horus) - fixed compatibility with quickjs-ng 0.16.0 and later
Below is a release summary generated by GitHub.
What's Changed
- QuickJS: add missing btoa() and atob() by @xeioex in #1084
- Webcrypto: fix buffer overflow when exporting large keys to JWK by @xeioex in #1086
- QuickJS: fix unhandled rejection tracking in reused contexts by @xeioex in #1087
- Updated security reporting methods by @Maryna-f5 in #1100
- Test262: accept ENOTEMPTY and EEXIST in fs/rename.t.mjs by @VadimZhestikov in #1104
- Modules: fix SharedDict.pop() for unexpired keys in timeout zones by @horus in #1102
- Webcrypto: fix RSA-OAEP digest being ignored for non-SHA-1 hashes by @tompsota in #1101
- Headers set validation by @xeioex in #1108
- Release tarball target by @xeioex in #1105
- Reqest headers validation by @xeioex in #1111
- Pre js context reuse fixes hardening by @xeioex in #1112
- Fix compat with quickjs ng 0.16 by @xeioex in #1115
New Contributors
- @Maryna-f5 made their first contribution in #1100
- @GuillaumeRossolini made their first contribution in #1103
- @horus made their first contribution in #1102
- @tompsota made their first contribution in #1101
Full Changelog: 1.0.0...1.0.1