CVE-2019-11837

HIGH

njs <= 0.3.1 - Denial of Service via String.prototype.toBytes Negative Argument

Title source: llm

Description

njs through 0.3.1, used in NGINX, has a segmentation fault in String.prototype.toBytes for negative arguments, related to nxt_utf8_next in nxt/nxt_utf8.h and njs_string_offset in njs/njs_string.c.

References (1)

Core 1

Core References

Exploit, Issue Tracking, Third Party Advisory x_refsource_misc

https://github.com/nginx/njs/issues/155

Scores

CVSS v3 7.5

EPSS 0.0028

EPSS Percentile 51.8%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-189

Status published

Products (1)

f5/njs < 0.3.1

Published May 09, 2019

Tracked Since Feb 18, 2026