Skip to content
fr Sign in
8.1 High

CVE-2026-8711 NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled…

Description

NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the ngx.fetch() operation from NGINX JavaScript. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products and versions

Product Affected versions Fixed in
NGINX JavaScript 0.9 0.9.4 → < 0.9.9 0.9.9

References

Timeline

  1. Published
  2. Last modified

Other CVEs of NGINX JavaScript

The 6 CVEs of NGINX JavaScript →
CVE-2026-101025 Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when… 5.3 Medium CVE-2026-101019 Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes… 6.5 Medium CVE-2026-78689 Description NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list parser, reachable… 8.1 High CVE-2026-78222 A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX… 7.5 High
Track this CVE