CVE-2026-8711
HighCVSS 8.1Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the ngx.fetch() operation from NGINX JavaScript. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Risk Assessment
An unauthenticated attacker could cause a crash of the NGINX worker process (DoS) or potentially execute code on the server if ASLR is disabled or bypassable.
Recommendation
Update NGINX JavaScript to the latest version and avoid using client-controlled variables in the js_fetch_proxy directive.
Other vulnerabilities in NGINX JavaScript
See all- CVE-2026-78222High
A vulnerability in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response.
- CVE-2026-18329High
A vulnerability in NGINX JavaScript (njs) and QuickJS (qjs) engines where an exception during asynchronous access-control evaluation can cause the js_access phase to fail open, allowing the request to proceed instead of being denied.
Original NVD description (English source)
NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the ngx.fetch() operation from NGINX JavaScript. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.