nginx/njs 1.0.2

on GitHub

njs-1.0.2 has been released with fixes for two XML security issues:

• Memory exhaustion when repeatedly parsing malformed XML in the njs engine (CVE-2026-101025). A memory leak could exhaust worker process memory.
• Inconsistent XML attribute values when attributes contained entity references (CVE-2026-101019). JavaScript accessors could return values different from those used by XML canonicalization, affecting signed XML validation.

The release also hardens the Fetch client: response body framing and keepalive connection reuse are now handled correctly, responses with conflicting Content-Length fields, both Transfer-Encoding and Content-Length, or 1xx status codes are rejected, and max_response_body_size is enforced for chunked responses.

XML support gains namespace-aware XMLNode.getAttributeNS() and XMLNode.getChildNS() methods, along with fixes for stale node references after tree mutations, crashes during repeated modifications, and document leaks in the QuickJS engine.

XML API compatibility changes: node mutation and canonicalization now reject detached nodes, and a removed child node has an undefined $parent. Text and attribute values must be primitive strings; null and undefined retain their deletion semantics. addChild() and $tags reject source trees with namespaces. Assigning to $tag$name now throws TypeError in the QuickJS engine; deletion remains supported.

Other notable changes:

• reduced compilation memory consumption in the njs engine and released temporary parser and generator data after compilation
• switched WebCrypto HMAC signature verification to constant-time comparison
• fixed memory leaks and false unhandled promise rejection reports in the QuickJS integration, and invalid memory accesses when formatting rejection reasons in the QuickJS shell
• fixed oversized Buffer allocation lengths and invalidated zlib dictionary memory in the QuickJS engine
• fixed crashes after failed module compilation, excessive resource usage when sorting huge sparse arrays, and memory corruption in RegExp operations in the njs engine
• fixed parsing of js_periodic options following worker_affinity in HTTP and Stream configurations
• make test262 now runs the official Test262 suite and requires NJS_TEST262_DIR

Below is a release summary generated by GitHub.

What's Changed

• Pr1116 symbol replace by @xeioex in #1119
• Fixed "for" statement processing by @xeioex in #1118
• Fix the runtime model in the agent developer guide by @xeioex in #1120
• Fuzzer issues by @xeioex in #1121
• Parser memory reduction by @xeioex in #1122
• Xml modify in place by @xeioex in #1124
• NJS test262 runner by @xeioex in #1125
• TypedArray: coerce length argument once on buffer construction by @basavaraj-sm05 in #1123
• Fetch hardening by @xeioex in #1126
• Memory pool fixes by @xeioex in #1128
• Various fixes by @xeioex in #1130
• Improved unhandled rejection tracking by @xeioex in #1131
• Xml hardening by @xeioex in #1132
• Module loading regression fixes by @xeioex in #1134

New Contributors

• @basavaraj-sm05 made their first contribution in #1123

Full Changelog: 1.0.1...1.0.2