---
id: CVE-2026-23919
title: >-
  For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape)
  contexts (used in script items, JavaScript reprocessing, Webhooks)
summary: >-
  For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape)
  contexts (used in script items, JavaScript reprocessing, Webhooks). This can
  lead to confidentiality loss where a regular (non-super) Zabbix administrator
  leaks data…
severity: medium
cvss: 6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L'
cwe:
  - CWE-488
vendor: zabbix
product: zabbix
affected:
  - 'zabbix >= 6.0.0, < 6.0.42'
  - 'zabbix >= 7.0.0, < 7.0.19'
  - 'zabbix >= 7.2.0, < 7.2.13'
  - 'zabbix >= 7.4.0, < 7.4.3'
patched:
  - zabbix 7.4.3
published: '2026-03-24'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T17:07:18.850'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-23919'
references:
  - url: 'https://support.zabbix.com/browse/ZBX-27638'
    label: security@zabbix.com
tags:
  - nvd
epss: 0.00244
epssPercentile: 0.15855
ingestedAt: '2026-09-18T17:46:41.511Z'
---

## Overview

For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (non-super) Zabbix administrator leaks data for hosts they do not have access to. A fix has been released that makes the built in Zabbix JavaScript objects read-only, but please be advised that usage of global JavaScript variables is not recommended because their content could be leaked. More information <a href='https://www.zabbix.com/documentation/7.4/en/manual/installation/known_issues#preprocessing-global-variables-are-unsafe'>in Zabbix documentation</a>.

## Affected

- `zabbix >= 6.0.0, < 6.0.42`
- `zabbix >= 7.0.0, < 7.0.19`
- `zabbix >= 7.2.0, < 7.2.13`
- `zabbix >= 7.4.0, < 7.4.3`

## Remediation

Upgrade past the affected range:

- `zabbix 7.4.3`