{"id":"CVE-2022-27008","details":"nginx njs 0.7.2 is vulnerable to Buffer Overflow. Type confused in Array.prototype.concat() when a slow array appended element is fast array.","modified":"2026-08-12T13:32:32.780909Z","published":"2022-04-14T14:04:56Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/27xxx/CVE-2022-27008.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/27xxx/CVE-2022-27008.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-27008"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20220519-0008/"},{"type":"REPORT","url":"https://github.com/nginx/njs/issues/471"},{"type":"FIX","url":"https://github.com/nginx/njs/commit/e673ae41a998d1391bd562edb2ed6d49db7cc716"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nginx/njs","events":[{"introduced":"50bb20a814c3c82b662c999630ce91ff068e3e48"},{"fixed":"e673ae41a998d1391bd562edb2ed6d49db7cc716"}],"database_specific":{"source":["CPE_STRING","REFERENCES"],"cpe":"cpe:2.3:a:f5:njs:0.7.2:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0.7.2"},{"last_affected":"0.7.2"}]}}],"versions":["0.7.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-27008.json","vanir_signatures_modified":"2026-08-12T13:32:32Z","vanir_signatures":[{"digest":{"line_hashes":["286191045354529882396740339644735296472","316780131915622020408303156242938990206","181382248073213818382603782539801578146"],"threshold":0.9},"id":"CVE-2022-27008-1dc9d0ab","signature_type":"Line","signature_version":"v1","source":"https://github.com/nginx/njs/commit/e673ae41a998d1391bd562edb2ed6d49db7cc716","target":{"file":"src/test/njs_unit_test.c"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"83705897729495263705284045029005404880","length":927},"id":"CVE-2022-27008-7352925d","signature_type":"Function","signature_version":"v1","source":"https://github.com/nginx/njs/commit/e673ae41a998d1391bd562edb2ed6d49db7cc716","target":{"file":"src/njs_array.c","function":"njs_array_expand"}},{"digest":{"function_hash":"60624386110504712699579016151394775546","length":2079},"id":"CVE-2022-27008-7bd205ac","signature_type":"Function","signature_version":"v1","source":"https://github.com/nginx/njs/commit/e673ae41a998d1391bd562edb2ed6d49db7cc716","target":{"file":"src/njs_array.c","function":"njs_array_prototype_concat"},"deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["48241974990846658713313821784833087175","255892893843865148440688413348679083444","38328431894080283965435394860074998608","148660513481489026456076781025019725824","195848396845944515574882684204123083977","180341844466080205318362789255831835170","143960762337730777257097786448965919329","49696200087777734619665511529601056911","122705887846865894578818938490005853615"]},"id":"CVE-2022-27008-f5ae3ac1","signature_type":"Line","signature_version":"v1","source":"https://github.com/nginx/njs/commit/e673ae41a998d1391bd562edb2ed6d49db7cc716","target":{"file":"src/njs_array.c"},"deprecated":false}]}}],"schema_version":"1.9.0"}