CVE-2019-11837

njs through 0.3.1, used in NGINX, has a segmentation fault in String.prototype.toBytes for negative arguments, related to nxt_utf8_next in nxt/nxt_utf8.h and njs_string_offset in njs/njs_string.c.

• CWE-189

• https://github.com/nginx/njs/issues/155Exploit, Issue Tracking, Third Party Advisory
• https://github.com/nginx/njs/issues/155Exploit, Issue Tracking, Third Party Advisory

Published

May 9, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11831The PharStreamWrapper (aka phar-stream-wrapper) package 2.x …9.8
• CVE-2019-11832TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 allows remote c…
• CVE-2019-11833fs/ext4/extents.c in the Linux kernel through 5.1.2 does not…5.5
• CVE-2019-11834cJSON before 1.7.11 allows out-of-bounds access, related to …9.8
• CVE-2019-11835cJSON before 1.7.11 allows out-of-bounds access, related to …9.8
• CVE-2019-11836The Rediffmail (aka com.rediff.mail.and) application 2.2.6 f…
• CVE-2019-11838njs through 0.3.1, used in NGINX, has a heap-based buffer ov…
• CVE-2019-11839njs through 0.3.1, used in NGINX, has a heap-based buffer ov…
• CVE-2019-1184An elevation of privilege vulnerability exists when Windows …6.7
• CVE-2019-11840An issue was discovered in the supplementary Go cryptography…5.9
• CVE-2019-11841A message-forgery issue was discovered in crypto/openpgp/cle…5.9
• CVE-2019-11842An issue was discovered in Matrix Sydent before 1.0.3 and Sy…