ALAS2023-2026-3095

References: CVE-2026-18329  CVE-2026-78222  CVE-2026-78689 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

Description

NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request that triggers an error condition in the access validation logic. This may cause the js_access phase to fail open, allowing the request to proceed instead of being denied, resulting in an authentication or authorization bypass and unauthorized access to protected resources.

Impact

This vulnerability may allow remote attackers to bypass js_access controls. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. (CVE-2026-18329)

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response.

Impact:
This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. (CVE-2026-78222)

Description

NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n() method. An unauthenticated remote attacker can trigger it when an affected NGINX configuration passes an externally controlled XML namespace prefix list to that method. Both the njs and the QuickJS (qjs) engines are affected. A crafted prefix list causes an out-of-bounds write past the end of a heap allocation. With the njs engine, which is the engine used when the js_engine directive is absent, this corrupts adjacent objects and crashes the NGINX worker. With the QuickJS engine, the same call additionally leaks the prefix list on every invocation, causing worker memory to grow across requests. The official nginxinc/nginx-saml reference implementation is affected during SAML signature verification. It reads InclusiveNamespaces/@PrefixList from an untrusted SAML message and passes it to xml.exclusiveC14n() before the signature has been verified, so a valid SAML signature is not required. A crafted SAML Response, Assertion, LogoutRequest, or LogoutResponse is sufficient. Code execution has not been demonstrated and cannot be ruled out for all platforms, as the effect of the out-of-bounds write depends on conditions beyond the attacker's control.

Impact

This vulnerability allows remote attackers to cause a denial of service on the NGINX system, either through repeatable worker restarts or through worker memory growth or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. (CVE-2026-78689)

Issue Correction:
Run dnf update nginx-mod-njs --releasever 2023.12.20260928 or dnf update --advisory ALAS2023-2026-3095 --releasever 2023.12.20260928 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    nginx-mod-njs-debuginfo-1.0.1-1.amzn2023.0.1.aarch64
    nginx-mod-njs-1.0.1-1.amzn2023.0.1.aarch64
    nginx-mod-njs-debugsource-1.0.1-1.amzn2023.0.1.aarch64

src:
    nginx-mod-njs-1.0.1-1.amzn2023.0.1.src

x86_64:
    nginx-mod-njs-debuginfo-1.0.1-1.amzn2023.0.1.x86_64
    nginx-mod-njs-1.0.1-1.amzn2023.0.1.x86_64
    nginx-mod-njs-debugsource-1.0.1-1.amzn2023.0.1.x86_64