FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

angie-module-njs -- multiple vulnerabilities

Affected packages
		angie-module-njs	<	1.0.2,1

Details

VuXML ID	a1ee2283-de8c-11f1-bae2-3497f65b111b
Discovery	2026-10-14
Entry	2026-11-12

The njs development team reports:

Memory leak when parsing malformed XML in the njs engine (CVE-2026-101025). Repeated malformed input could exhaust worker process memory. Affects 0.7.10-1.0.1.

Incomplete XML attribute values containing entity references (CVE-2026-101019). JavaScript accessors could return values different from those used by XML canonicalization, affecting signed XML validation. Affects 0.7.10-1.0.1.

[source]

References

CVE Name	CVE-2026-101019
CVE Name	CVE-2026-101025
URL	https://nginx.org/en/docs/njs/changes.html#njs1.0.2
URL	https://nginx.org/en/docs/njs/security.html#advisories