{"id":"CVE-2022-43286","details":"Nginx NJS v0.7.2 was discovered to contain a heap-use-after-free bug caused by illegal memory copy in the function njs_json_parse_iterator_call at njs_json.c.","modified":"2026-08-13T14:07:42.024776Z","published":"2022-10-28T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/43xxx/CVE-2022-43286.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/43xxx/CVE-2022-43286.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43286"},{"type":"REPORT","url":"https://github.com/nginx/njs/issues/480"},{"type":"FIX","url":"https://github.com/nginx/njs/commit/2ad0ea24a58d570634e09c2e58c3b314505eaa6a"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nginx/njs","events":[{"introduced":"50bb20a814c3c82b662c999630ce91ff068e3e48"},{"fixed":"2ad0ea24a58d570634e09c2e58c3b314505eaa6a"}],"database_specific":{"cpe":"cpe:2.3:a:f5:njs:0.7.2:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0.7.2"},{"last_affected":"0.7.2"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["0.7.2","0.7.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-43286.json","vanir_signatures_modified":"2026-08-13T14:07:42Z","vanir_signatures":[{"id":"CVE-2022-43286-18405767","signature_type":"Function","signature_version":"v1","source":"https://github.com/nginx/njs/commit/2ad0ea24a58d570634e09c2e58c3b314505eaa6a","target":{"file":"src/njs_json.c","function":"njs_json_pop_parse_state"},"deprecated":false,"digest":{"function_hash":"212275849317984151066165185631303355172","length":287}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["133998181486505963782311897367318452209","538989235463723849199544271926506276","178090826898043005868731557494104714973"]},"id":"CVE-2022-43286-4f87ced8","signature_type":"Line","signature_version":"v1","source":"https://github.com/nginx/njs/commit/2ad0ea24a58d570634e09c2e58c3b314505eaa6a","target":{"file":"src/test/njs_benchmark.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/nginx/njs/commit/2ad0ea24a58d570634e09c2e58c3b314505eaa6a","target":{"file":"src/njs_json.c","function":"njs_json_push_parse_state"},"deprecated":false,"digest":{"length":481,"function_hash":"200905684429621691779637995935168505994"},"id":"CVE-2022-43286-51a0d8ae"},{"source":"https://github.com/nginx/njs/commit/2ad0ea24a58d570634e09c2e58c3b314505eaa6a","target":{"file":"src/njs_json.c","function":"njs_json_parse_iterator_call"},"deprecated":false,"digest":{"function_hash":"296451647136411897655922002957891689311","length":1202},"id":"CVE-2022-43286-5753d256","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"46411329095591969416500553875237887922","length":1238},"id":"CVE-2022-43286-612bc225","signature_type":"Function","signature_version":"v1","source":"https://github.com/nginx/njs/commit/2ad0ea24a58d570634e09c2e58c3b314505eaa6a","target":{"function":"njs_json_parse","file":"src/njs_json.c"},"deprecated":false},{"id":"CVE-2022-43286-8759b090","signature_type":"Line","signature_version":"v1","source":"https://github.com/nginx/njs/commit/2ad0ea24a58d570634e09c2e58c3b314505eaa6a","target":{"file":"src/njs_json.c"},"deprecated":false,"digest":{"line_hashes":["281745333988207490767920895095867600647","167125231790099603817618040358857277376","46063534476814732419167317647132008778","169713123915800323154559568935864037995","185338519680394894490519927684227320918","129038094165753130475147845856918219690","238819462033879858453044654757387677683","275727080407370875289794881664750073119","122060905281096951941346395660768415847","296310731195641657658948215913886444966","183540690403868612609005244190265836999","228517723622454495382862593051260848324","143068444686879084074785910706500465128","322032182858511306299794915354203394151","274900236963076980896309000097022386917","225292936377855945019599001716863296894","88202348701580113359193289396209183469","75219950613029596660142219816331194724","271053693480550246697668037063073465392","277898295215661639972235585216029404620","239151352715842031524885119753385793612","310960085428094331430080679096078812106","76121668864222985636518480454116414933","226222133708140832473366765959790754576","158791538448141465946006326452269657195","112251901887772737305255040813935487776","197024717146170884664099008845338975795","212652527401563757817113362817782726377","40910615808828055537465549550738700497","193284035931353985238837506590423896973","135332847280588951963882188843566816160","157632146518652493163841317310446728988","268694538014469862341567941914408979719","124980587419573554301926997545685277566","233977772541419973428468508791948061325","197711702391104331735468492142313088986","327519323471382679728676854698088089500","313325234569748603367072861993298585677","71252390157982186720031324930382748530","3816987866986311594125756639037639372","96211309224729035934022997452542080415","193838752525408974504128788144622072949","252732205397663723616131032183653718159","304227685036160166987535110056255661862","20059893912806172358975789233583007359","111588847999522720851446945130251575651","156335280578715113075618284744291239070","176527911563103584629765979511132467507","334295532780791123767851799436695958284","334811619413395269311915311050858435811","113049526881211713110156225264610260379","97036624421031996858125214360744695597","64071288074846819838159182224768200272","207758156939803000122194985258791915895","100321236743139053317782063424744158766","164225436779478622153459366409099970585","137408914078665878916605056700342443768","24963191715526788594529273562939682920","161666494394101446543626935849422834396","256105742295087341453546791634893438923","314939356297727843510143305702542425094","131720651697408435623960809535249733766","263913206851760224389303741183729847101","200653068538783209812364586658877684970","2033805292966826455487197332405709162","285025010230625497029776234727045308973","338220306552327510056843164855709278777","50029419095867124888533497784472329418","75873122422953001735118079711210464788","328184489055605211586885937988743160569","156798091335762780574727163617853456060","242294715483407203795634455587111694903","259334760112423842308042141409391516487","101308219870615441921861890398424271997","202640611200814282888266641385658174762","52469810312387543195832429769439224866","330080042182826299049767018377937401582","65387059083052188735468964884682849860","98932824644789081756404424276752480509","183848049597859985282490558565459039419","319580100329354711878949649294272599033","117076662698434625827254104153747870088","95924474653766101380371907497373260059","155455704829333478760086963834453073407","140717872713804550078648676627950981392","267775056350989079320244362160413109093","140419975772670031838208643345741015098","59849036281965097840941707824320331511","68440051081548013393604510295690060033","24368652289429617240082615099773641700","336480683849646633165512079942420023657","257915648135239838426853475979561059576","233281611295611942482284749464800055943","217167932574752800185964333878947341551","107428468377876311641320047477646776849","313387189815863189775467459029028758337","228299250039853728530250550852372384912","27876490792248310652852030524344107246","102987244480617539077629331675069747807","8340271020050208449005993170867372579","322531408242510216857087175271116452271","312841200484616131686141805364576276656","182969384925051210628332470477032822015","126175204305997218320077293923543584576","265969926412301799974721688342252908534","58926956050793124017853985791997726207","180140673051942273108188274495143944143","10271924747263752656236232449907103923","314995124587852577878545688200352732286","245170571038479262468007345758695234212","278075701603935570991727707557529855183","169872467391328424490273234987431694587","10979305557571061337905321555044018679","19019087984474382331986935016281576961","131608910631444660626209107343660315231","151750625665313777298459517110271976401","110299758935541919924163163956927203102","284021815356735181021561406143749143575","51985236275513419178599343740214635649","49358339685057062225405921494188229422","215079740882162529295201508035666842503","311243623016211390639872558995219456652","272982905564908887919369959313633388041","19019087984474382331986935016281576961","131608910631444660626209107343660315231","89139568688481230195991468326335389188","210221925150507431949804045724656047986","284232258947739355786970672949205977550","251456085045237716065872694663299195385","44727026317432968390420635280613938576","85801028403888247514420232655848248573","195927720037685273995819390723187569514","278470394854070157755741734326314167029","244996511225454113723255828740237547342","75253459650265590865899334170321542169","208799437559177853530781990849303391554","94348806671035242848044602200256912378","15245978077281893038792388904386048629","185980905089044417366923875655120253313","42569254393177059354812440925092403776","231940909045556025508739668985189928849","15617550801298534898381283942965966689","287123341089668117520138661536024072059","21600341025430120795785439232937950745","44102972024074107003170999855930350666","200086497182520979170115853663870455035","106254559600047119986145650731533991071","24310564694032630926202149971806542587","257500279647059621875964179914601016790","200083390167952745937632274203197023725","513701598373638598644696582372983804","72598556849741676125406076920174272760","47208066900787474385056492649775387690","130429216329045512600358972204909680707","206908952465175922474896081563782725660","49313389320154657390115860875805157164","246702300743874374293797312891100226543","221940531707888140128855643534056074157","154035730178027037476768946302589880113","233763556429041251612961204658563973763","337898383165742662197288961313701926355","121150795701734204729348963460456721541","48216051948748138043894457425745616352","136490907185592136675350231006729391237","21670966094356631773921598587985626999","281704401500830562951563081695238008007","134709658300789164608491033160640509565","244721906227691998417599933728426292128","206908952465175922474896081563782725660","49313389320154657390115860875805157164","246702300743874374293797312891100226543","266860470875280521370173341738602930100","171450276842075358621680787464279446610","146329322218405725981952477443919890371","107598916093688039918186640559028572699","195314658536801265740566508779027994168","75074796402071148222033392879537786831","226843820360912450454485920405505072961","120457100873950342102422614899686562520","327830847734117651638522134247048614106","44543232571199267242916786825646477773","310831386449984677329421211424795087164","95064993403699890789836671946684900170","219066972366534473356580050446659198226","100453630490791673548807151969344408853","203339820797047534060877518571409271174","201283519961522323188283566121366392981","328830851459012302499328646410346722999","139679144014452419286557355031973883335"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["274362632255914090026457824926723679321","51462993081627396656626364382104714089","84469597337928678070800686999682210974"],"threshold":0.9},"id":"CVE-2022-43286-ad430399","signature_type":"Line","signature_version":"v1","source":"https://github.com/nginx/njs/commit/2ad0ea24a58d570634e09c2e58c3b314505eaa6a","target":{"file":"src/test/njs_unit_test.c"}},{"deprecated":false,"digest":{"function_hash":"255072888608068745380231875734009538051","length":1406},"id":"CVE-2022-43286-cf18d0bc","signature_type":"Function","signature_version":"v1","source":"https://github.com/nginx/njs/commit/2ad0ea24a58d570634e09c2e58c3b314505eaa6a","target":{"file":"src/njs_json.c","function":"njs_json_parse_iterator"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}