Security readout for executives and security teams
Plain-English summary
This CVE describes a memory safety flaw in njs, the JavaScript engine used with NGINX, through version 0.4.3. A use-after-free can cause unreliable behavior and may create security risk where vulnerable njs processing is reachable. The source bundle does not provide CVSS, CWE, fixed-version, or confirmed exploitation details.
Executive priority
Prioritize inventory and vendor verification rather than emergency action. Escalate remediation if njs through 0.4.3 is confirmed on internet-facing or business-critical NGINX services.
Technical view
CVE-2020-24346 is a use-after-free in njs_json_parse_iterator_call in njs_json.c affecting njs through 0.4.3. The bundle links the upstream nginx/njs issue and a NetApp advisory but lacks affected CPEs, CVSS scoring, and detailed exploitability conditions. Treat exposure as component-dependent, especially where NGINX uses njs JSON parsing paths.
Likely exposure
Likely exposure is limited to environments using njs through 0.4.3 with NGINX, or products embedding that component. The bundle’s affected-product metadata is incomplete, so product exposure should be verified against vendor advisories and local package inventories.
Exploitation context
The provided sources do not show CISA KEV listing or confirmed active exploitation. The issue is memory-safety related, but the bundle does not establish whether exploitation is practical, remote, authenticated, or limited to crash conditions.
Researcher notes
The strongest facts are component, version ceiling, and vulnerable function. The bundle lacks CVSS, CWE, exploit prerequisites, and precise downstream affected products. Avoid assuming all NGINX deployments are affected; confirm njs use and vendor-specific exposure.
Mitigation direction
- Inventory NGINX deployments and confirm whether njs is installed or enabled.
- Identify any njs versions at or below 0.4.3.
- Review upstream nginx/njs issue 325 for vendor context.
- Check NetApp and other vendor advisories for affected products and fixes.
- Apply vendor-supported updates or workarounds when identified.
Validation and detection
- Query package inventories for installed njs and NGINX module versions.
- Review NGINX configuration for active njs usage.
- Map embedded appliance exposure against vendor advisories.
- Confirm remediation by verifying njs version after updates.
- Document systems where exposure cannot be confirmed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-24346 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/nginx/njs/issues/325CVE reference · x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20200918-0001/CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.