www/angie-module-njs: Security update to 1.0.1
This maintenance update of njs fixes three security issues:
- Access control bypass in js_access when an asynchronous request body continuation threw an exception or produced an unhandled rejection (CVE-2026-18329). Previously, nginx could continue processing the request as though the js_access check had succeeded. Affects 0.9.9-1.0.0. Thanks to Ta Duc Thien.
- Worker process crash when reading Response.statusText after an upstream server returned a status line with an empty reason phrase (CVE-2026-78222). Affects 0.5.1-1.0.0.
- Heap buffer overflow while parsing namespace prefix lists passed to xml.exclusiveC14n() (CVE-2026-78689). Affects 0.7.10-1.0.0. Thanks to Vladimir, Vulnerability Research Tech Lead @ Cyera, evilgensec.
PR: 298637
Changes: https://github.com/nginx/njs/releases/tag/1.0.1
Security: 6cf326a2-b38c-11f1-a655-3497f65b111b
Sponsored by: Netzkommune GmbH
(cherry picked from commit 2c7dcffde5e2e02b572e2f2d3935d328a2e72478)