{"id":"CVE-2022-28049","details":"NGINX NJS 0.7.2 was discovered to contain a NULL pointer dereference via the component njs_vmcode_array at /src/njs_vmcode.c.","modified":"2026-08-12T13:32:32.018242Z","published":"2022-04-15T13:06:37Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/28xxx/CVE-2022-28049.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/28xxx/CVE-2022-28049.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28049"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20220519-0008/"},{"type":"REPORT","url":"https://github.com/nginx/njs/issues/473"},{"type":"FIX","url":"https://github.com/nginx/njs/commit/f65981b0b8fcf02d69a40bc934803c25c9f607ab"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nginx/njs","events":[{"introduced":"50bb20a814c3c82b662c999630ce91ff068e3e48"},{"fixed":"f65981b0b8fcf02d69a40bc934803c25c9f607ab"}],"database_specific":{"cpe":"cpe:2.3:a:f5:njs:0.7.2:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0.7.2"},{"last_affected":"0.7.2"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["0.7.2"],"database_specific":{"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/nginx/njs/commit/f65981b0b8fcf02d69a40bc934803c25c9f607ab","target":{"file":"src/njs_vmcode.c"},"deprecated":false,"digest":{"line_hashes":["9377267118167365229505832544491307486","29970220827004356682971917998289867578","238797592912100748851190390963520861874","127832424442740760489415098555024002640","3212120587541932173212486345833266161","39286889187378846998578732085958704618","205081915744326660929531901405527843522","294766206234032382222601840342149320257","220010071858347038105721430227173623700","139671978284284188210657282431762046166"],"threshold":0.9},"id":"CVE-2022-28049-32df66a9"},{"deprecated":false,"digest":{"function_hash":"304766567493603327196389522884897110500","length":475},"id":"CVE-2022-28049-bfe17204","signature_type":"Function","signature_version":"v1","source":"https://github.com/nginx/njs/commit/f65981b0b8fcf02d69a40bc934803c25c9f607ab","target":{"file":"src/njs_vmcode.c","function":"njs_vmcode_array"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["15117651345907187282798790153806249899","238853738105931232638586210688610072959","329112596843107572737561569335794907890"]},"id":"CVE-2022-28049-d8e76184","signature_type":"Line","signature_version":"v1","source":"https://github.com/nginx/njs/commit/f65981b0b8fcf02d69a40bc934803c25c9f607ab","target":{"file":"src/test/njs_unit_test.c"}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-28049.json","vanir_signatures_modified":"2026-08-12T13:32:32Z"}}],"schema_version":"1.9.0"}