Memory Leak Vulnerability in NGINX JavaScript Engine

CVE-2026-101025

What is CVE-2026-101025?

The NGINX JavaScript (njs) engine contains a flaw that allows for a memory leak when the built-in xml.parse() function encounters malformed XML. During parsing failures, the necessary cleanup is not performed, resulting in the libxml2 parser context remaining allocated for the lifetime of the NGINX worker process. This oversight could be exploited by unauthorized attackers to send specially crafted requests with malformed XML, leading to excessive memory consumption and potential termination of long-lived NGINX processes. As a result, this vulnerability poses a risk of denial of service, affecting the performance and reliability of the web services reliant on this component.

References