CVE-2019-13067

CRITICAL

njs < 0.3.3 - Out-of-bounds Read in nxt_utf8_decode

Title source: llm

Description

njs through 0.3.3, used in NGINX, has a buffer over-read in nxt_utf8_decode in nxt/nxt_utf8.c. This issue occurs after the fix for CVE-2019-12207 is in place.

References (1)

Core 1

Core References

Exploit, Issue Tracking, Third Party Advisory x_refsource_misc

https://github.com/nginx/njs/issues/183

Scores

CVSS v3 9.8

EPSS 0.0160

EPSS Percentile 72.8%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-125

Status published

Products (1)

f5/njs < 0.3.3

Published Jun 30, 2019

Tracked Since Feb 18, 2026