{"id":"CVE-2022-27007","details":"nginx njs 0.7.2 is affected suffers from Use-after-free in njs_function_frame_alloc() when it try to invoke from a restored frame saved with njs_function_frame_save().","modified":"2026-07-22T02:24:44.825377Z","published":"2022-04-14T14:08:19Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/27xxx/CVE-2022-27007.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/27xxx/CVE-2022-27007.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-27007"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20220519-0008/"},{"type":"REPORT","url":"https://github.com/nginx/njs/issues/469"},{"type":"FIX","url":"https://github.com/nginx/njs/commit/ad48705bf1f04b4221a5f5b07715ac48b3160d53"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nginx/njs","events":[{"introduced":"50bb20a814c3c82b662c999630ce91ff068e3e48"},{"fixed":"ad48705bf1f04b4221a5f5b07715ac48b3160d53"}],"database_specific":{"extracted_events":[{"introduced":"0.7.2"},{"last_affected":"0.7.2"}],"source":["CPE_STRING","REFERENCES"],"cpe":"cpe:2.3:a:f5:njs:0.7.2:*:*:*:*:*:*:*"}}],"versions":["0.7.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-27007.json","vanir_signatures_modified":"2026-07-22T02:24:44Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/nginx/njs/commit/ad48705bf1f04b4221a5f5b07715ac48b3160d53","target":{"file":"src/njs_function.c"},"deprecated":false,"digest":{"line_hashes":["138421633129488864937735872599000506234","27039259651221790653411306071683155797","331539492576269881793117942121947427386","329790762949194910835705026888280855784","127358985363884583393220151483745842230","61914521830780938963912752065750193512"],"threshold":0.9},"id":"CVE-2022-27007-7ea5bcb3"},{"id":"CVE-2022-27007-a72d8ace","signature_type":"Function","signature_version":"v1","source":"https://github.com/nginx/njs/commit/ad48705bf1f04b4221a5f5b07715ac48b3160d53","target":{"file":"src/njs_function.c","function":"njs_function_frame_save"},"deprecated":false,"digest":{"function_hash":"254256718481189875352576299876034585016","length":992}}]}}],"schema_version":"1.7.5"}