CVE-2019-11838

njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in Array.prototype.splice after a resize, related to njs_array_prototype_splice in njs/njs_array.c, because of njs_array_expand size mishandling.

• CWE-787

• https://github.com/nginx/njs/issues/153Exploit, Issue Tracking, Third Party Advisory
• https://github.com/nginx/njs/issues/153Exploit, Issue Tracking, Third Party Advisory

Published

May 9, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11832TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 allows remote c…
• CVE-2019-11833fs/ext4/extents.c in the Linux kernel through 5.1.2 does not…5.5
• CVE-2019-11834cJSON before 1.7.11 allows out-of-bounds access, related to …9.8
• CVE-2019-11835cJSON before 1.7.11 allows out-of-bounds access, related to …9.8
• CVE-2019-11836The Rediffmail (aka com.rediff.mail.and) application 2.2.6 f…
• CVE-2019-11837njs through 0.3.1, used in NGINX, has a segmentation fault i…
• CVE-2019-11839njs through 0.3.1, used in NGINX, has a heap-based buffer ov…
• CVE-2019-1184An elevation of privilege vulnerability exists when Windows …6.7
• CVE-2019-11840An issue was discovered in the supplementary Go cryptography…5.9
• CVE-2019-11841A message-forgery issue was discovered in crypto/openpgp/cle…5.9
• CVE-2019-11842An issue was discovered in Matrix Sydent before 1.0.3 and Sy…
• CVE-2019-11843The MailPoet plugin before 3.23.2 for WordPress allows remot…6.1