CVE WATCH / VULNERABILITY DETAIL
CVE-2026-101025
MEDIUMCVSS 5.3NVD feed
Published 14 October 2026 · tracked since 15 October 2026
Description
Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests with
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-107381 MEDIUM 6.5
- CVE-2026-104939 HIGH 7.5
- CVE-2026-101019 MEDIUM 6.5
- CVE-2020-37282 CRITICAL 9.8
- CVE-2026-98417
- CVE-2026-98418
- CVE-2026-98419
- CVE-2026-98420
- CVE-2026-98409
- CVE-2026-98410