JavaScript Context Reuse Vulnerability in Zabbix Server/Proxy

CVE-2026-23919

What is CVE-2026-23919?

The reuse of JavaScript (Duktape) contexts in Zabbix Server/Proxy for performance optimization can lead to a potential confidentiality breach. A non-super Zabbix administrator may inadvertently leak sensitive data pertaining to hosts outside their access rights. A recent fix enforces read-only status for built-in Zabbix JavaScript objects; however, users are cautioned against using global JavaScript variables, as their contents may still be exposed. For further insights, you can refer to the Zabbix documentation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References