CVE-2026-78222: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-78222 is a NULL Pointer Dereference vulnerability in NGINX JavaScript (njs) that allows remote attackers to crash an NGINX worker process by delivering a malformed HTTP response to the ngx.fetch() function when trusted JavaScript subsequently reads Response.statusText. The vulnerability affects NGINX JavaScript versions 0.5.1 through less than 1.0.1, developed by F5. It was published on September 2, 2026, with a patch made available the same day. The vulnerability carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory, Feedly).

The root cause is a NULL Pointer Dereference (CWE-476) in the NGINX JavaScript module's handling of HTTP responses fetched via ngx.fetch(). When a malformed HTTP response is received — one that causes Response.statusText to reference a NULL or invalid pointer — and trusted JavaScript code attempts to read that property, the NGINX worker process crashes. Exploitation is limited to the data plane only; there is no control plane exposure. An attacker must have control or influence over the HTTP response returned to the ngx.fetch() call, such as by operating or compromising an upstream server that the NGINX JavaScript code queries (GitHub Advisory, Feedly).

Successful exploitation results in a denial-of-service (DoS) condition by crashing the NGINX worker process. There is no impact on confidentiality or integrity — the vulnerability is availability-only. Repeated exploitation could crash multiple worker processes, effectively taking the NGINX instance offline. The impact is confined to the vulnerable NGINX system's data plane; no lateral movement or data exfiltration is possible through this vulnerability (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.33–0.37%, placing it in roughly the 30th percentile for exploitation likelihood within 30 days. Exploitation requires the attacker to control or influence an HTTP response fetched by the NGINX JavaScript code, which limits the attack surface to scenarios where ngx.fetch() is used against attacker-controlled or compromised upstream endpoints (GitHub Advisory).

1. Identify target: Locate an NGINX instance running NGINX JavaScript (njs) versions 0.5.1 to <1.0.1 that uses ngx.fetch() to retrieve data from an external HTTP endpoint.
2. Gain influence over the fetched response: Position as a man-in-the-middle on the network path between the NGINX server and the upstream HTTP server, or operate/compromise the upstream server that NGINX JavaScript queries via ngx.fetch().
3. Craft a malformed HTTP response: Construct an HTTP response with a malformed or missing statusText field in the status line (e.g., an HTTP response line such as HTTP/1.1 200 \r\n with an empty or structurally invalid status text) that triggers a NULL pointer condition in the njs response parser.
4. Deliver the malformed response: Return the crafted response to the NGINX server when it makes the ngx.fetch() request.
5. Trigger the crash: When the trusted JavaScript code reads Response.statusText on the malformed response object, the NULL pointer dereference occurs, crashing the NGINX worker process and causing a denial-of-service condition (GitHub Advisory, Feedly).

• Logs: NGINX error logs (/var/log/nginx/error.log) showing worker process crash entries such as worker process XXXX exited on signal 11 (SIGSEGV) or similar segmentation fault messages correlated with ngx.fetch() activity.
• Process: Unexpected termination and respawn of NGINX worker processes (nginx: worker process) visible in system process monitoring or via systemctl status nginx.
• Network: Unusual or repeated HTTP responses from upstream servers with malformed status lines (e.g., missing or truncated statusText) captured in network traffic analysis tools such as Wireshark or tcpdump.
• System: Core dump files generated in the NGINX working directory or system core dump location following worker crashes, potentially containing crash context related to njs response parsing.

F5 has released NGINX JavaScript version 1.0.1 as the patched version; administrators should upgrade from any affected version in the range 0.5.1 to <1.0.1 (GitHub Advisory, F5 Advisory). As a workaround, avoid using ngx.fetch() to retrieve responses from untrusted or potentially attacker-influenced sources, and implement error handling in JavaScript code around Response.statusText access (e.g., wrapping in try/catch or validating response integrity before accessing status properties). Network-level controls restricting which upstream endpoints NGINX JavaScript can fetch from can also reduce exposure.

The vulnerability was noted in coverage of Microsoft's September 2026 Patch Tuesday, which fixed 966 flaws, indicating broad industry awareness of the disclosure cycle (BleepingComputer). Tenable published a Nessus detection plugin (plugin ID 342647) shortly after disclosure, reflecting standard vendor response to the advisory. No significant independent researcher commentary or social media discussion specific to this CVE has been identified beyond routine vulnerability tracking and aggregation.