A high severity vulnerability in the F5 NGINX JavaScript engine allows unauthenticated remote attackers to bypass critical access control mechanisms, potentially leading to unauthorized data access.

The flaw, classified as CWE-636, occurs when an exception is thrown during asynchronous access-control evaluation within a js_access handler. An unauthenticated attacker can exploit this condition to cause the access phase to fail open, effectively bypassing security policies and gaining unauthorized access to protected resources.

This vulnerability poses a significant risk to data confidentiality, as it permits unauthorized access to resources typically protected by access-control logic. With a CVSS score of 8.2, this issue is rated as High severity, reflecting the ease of exploitation and the potential for direct access to sensitive data plane traffic. Successful exploitation could lead to unauthorized information disclosure and loss of trust in the integrity of the application environment.

Immediate Action: Update F5 NGINX JavaScript to a non-affected version as specified in the vendor security advisory (K000162599).

Proactive Monitoring: Review web access logs for unusual patterns, specifically monitoring for frequent 500-series errors or unexpected successful requests to sensitive endpoints that should be restricted.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to filter and normalize incoming HTTP requests, ensuring that malformed traffic designed to trigger access-control exceptions is blocked before reaching the njs engine.

Public Exploit Available: Unknown

Given the High severity of this authentication bypass, organizations must prioritize patching their NGINX JavaScript implementations immediately. Failure to address this flaw leaves critical business resources exposed to unauthorized access from any remote, unauthenticated source. Please consult the official F5 security advisory to identify the specific patched version for your deployment environment and apply the update as part of your next maintenance cycle.