{"id":"CVE-2026-8711","title":"NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the ngx.fetch() operation from NGIN…","summary":"NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the ngx.fetch() operation from NGIN…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-122"],"vendor":"f5","product":"njs","affected":["njs >= 0.9.4, < 0.9.9"],"patched":["njs 0.9.9"],"published":"2026-05-19","updated":"2026-07-23","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8711","references":[{"url":"https://my.f5.com/manage/s/article/K000161307","label":"f5sirt@f5.com"}],"tags":["nvd"],"epss":0.09686,"epssPercentile":0.95289,"ingestedAt":"2026-07-23T20:19:19.340Z","slug":"CVE-2026-8711","body":"## Overview\n\nNGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the ngx.fetch() operation from NGINX JavaScript. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\n## Affected\n\n- `njs >= 0.9.4, < 0.9.9`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `njs 0.9.9`","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":44.6,"likelihood":1.9,"exploitation":0,"ransomware":0},"changes":[{"seq":186,"id":"CVE-2026-8711","ts":1787603691420,"field":"epss","old":"0.00889","new":"0.09686"}]}