diff options
| author | Sebastian Oswald <sko@rostwald.de> | 2026-09-18 13:09:15 +0000 |
|---|---|---|
| committer | Jochen Neumeister <joneum@FreeBSD.org> | 2026-09-18 18:29:31 +0000 |
| commit | 2c7dcffde5e2e02b572e2f2d3935d328a2e72478 (patch) | |
| tree | e6083ce6f383a64661e5375d37f3e55fc3baeb1d /math/ogdf | |
| parent | cf1ff7089f01a14a4bc2a44c205d0349b2a5cfb5 (diff) | |
This maintenance update of njs fixes three security issues:
- Access control bypass in js_access when an asynchronous request body
continuation threw an exception or produced an unhandled rejection
(CVE-2026-18329). Previously, nginx could continue processing the
request as though the js_access check had succeeded. Affects
0.9.9-1.0.0. Thanks to Ta Duc Thien.
- Worker process crash when reading Response.statusText after an
upstream server returned a status line with an empty reason phrase
(CVE-2026-78222). Affects 0.5.1-1.0.0.
- Heap buffer overflow while parsing namespace prefix lists passed to
xml.exclusiveC14n() (CVE-2026-78689). Affects 0.7.10-1.0.0. Thanks to
Vladimir, Vulnerability Research Tech Lead @ Cyera, evilgensec.
PR: 298637
Changes: https://github.com/nginx/njs/releases/tag/1.0.1
Security: 6cf326a2-b38c-11f1-a655-3497f65b111b
Sponsored by: Netzkommune GmbH
Diffstat (limited to 'math/ogdf')
0 files changed, 0 insertions, 0 deletions
