VULNERABILITY INTELLIGENCE

CVE-2019-11839

CVSS score9.8 CRITICAL

EPSS probability1.64%

CISA KEVNot currently listed

Published2019-05-09

Last modified2026-06-17

Description

njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in Array.prototype.push after a resize, related to njs_array_prototype_push in njs/njs_array.c, because of njs_array_expand size mishandling.