xeioex

NGINX JavaScript

NGINX JavaScript, also known as NJS, is a dynamic module for NGINX that enables the extension of built-in functionality using familiar JavaScript syntax. NJS supports modern JavaScript through its recommended QuickJS engine (ES2023). See JavaScript engines and compatibility for more details.

Table of Contents

• How it works

xeioex

/*
 * Minimal external QuickJS embedder reproducer.
 *
 * This file intentionally calls js_malloc() and js_free(), which are declared
 * in quickjs.h and defined as extern force_inline in quickjs.c.
 */

#include <quickjs.h>

xeioex

Summary

Complete the WebCrypto API implementation to cover the full W3C specification.

This branch adds the remaining algorithms and operations that were missing:

• Ed25519: sign/verify with EdDSA keys (import, export, generate in all formats)
• X25519: key agreement via deriveBits/deriveKey (import, export, generate in all formats)
• AES-KW: key wrapping algorithm for wrapKey/unwrapKey
• crypto.randomUUID(): UUID v4 generation
• wrapKey/unwrapKey: full implementation replacing the previous stubs, supporting both raw and JWK formats with all cipher algorithms

xeioex

xeioex

From 55165c8b2834ca46901b38a2910f0502a35a9bc3 Mon Sep 17 00:00:00 2001
From: Dmitry Volyntsev <xeioex@nginx.com>
Date: Thu, 5 Mar 2026 20:44:02 -0800
Subject: [PATCH 1/2] Modules: added var alias for variables object.

This allows to reference nginx variables with a shorter
syntax: `r.var.uri`  or `s.var.bytes_sent`.
---
 nginx/ngx_http_js_module.c    | 24 ++++++++++++++++++++++++
 nginx/ngx_stream_js_module.c  | 24 ++++++++++++++++++++++++

xeioex

xeioex

NJS for_fuzz.js Investigation (Codex, Refined)

Date: March 6, 2026

Reproducer:

for(function(){r({/a/;0;1)1

xeioex

NJS for_fuzz.js Investigation (Codex, Refined)

Date: March 6, 2026

Reproducer:

for(function(){r({/a/;0;1)1

xeioex

parser_refactor_method_frame vs master — Summary

Why

Spec compliance: ECMAScript requires arguments (including their side effects) to be evaluated before the callee's callability is checked. The old call lowering created the frame first, which threw non-callable errors before argument side effects ran.

Enable await in call arguments and tagged templates: The old frame-first

xeioex

Lowered AST Phase 1 Closeout

Status

Phase 1 is complete.

Implemented commits:

• 334e888a parser: lower method call property sources to PROPERTY_REF
• d8fd6e2b parser: lower property targets to PROPERTY_REF