CVE-2020-24349

MEDIUM

njs <= 0.4.3 - Use-After-Free in njs_value_property

Title source: llm

Description

njs through 0.4.3, used in NGINX, allows control-flow hijack in njs_value_property in njs_value.c. NOTE: the vendor considers the issue to be "fluff" in the NGINX use case because there is no remote attack surface.

References (3)

Core 3

Core References

Third Party Advisory x_refsource_misc

https://cwe.mitre.org/data/definitions/416.html

Exploit, Issue Tracking, Patch, Third Party Advisory x_refsource_misc

https://github.com/nginx/njs/issues/324

Third Party Advisory x_refsource_confirm

https://security.netapp.com/advisory/ntap-20200918-0001/

Scores

CVSS v3 5.5

EPSS 0.0006

EPSS Percentile 17.7%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Details

CWE

CWE-416

Status published

Products (1)

f5/njs < 0.4.3

Published Aug 13, 2020

Tracked Since Feb 18, 2026