CVE-2026-8711

Published: May 22, 2026Last modified: June 1, 2026

Description

NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the ngx.fetch() operation from NGINX JavaScript. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, for systems with Address Space Layout Randomization (ASLR) disabled, code execution is possible. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Severity score breakdown

ParameterValue
Base score9.8
Attack VectorNETWORK
Attack complexityLOW
Privileges requiredNONE
User interactionNONE
ScopeUNCHANGED
ConfidentialityHIGH
Integrity impactHIGH
Availability impactHIGH
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Notes

Introduced with njs-0.9.4. 23 LTS provides nginx wiht njs-0.7.7 which is not affected.

Status

ProductReleasePackageStatus
Alpaquita Linux23 LTSnginxNot affected (1.22.1-r0)
25 LTSnginxFixed (1.28.3-r4)
StreamnginxFixed (1.30.2-r1)

References

ON THIS PAGE