---
id: CVE-2026-8711
title: "NGINX JavaScript has a vulnerability when the js_fetch_proxy\_directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the ngx.fetch() operation from NGIN…"
summary: "NGINX JavaScript has a vulnerability when the js_fetch_proxy\_directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the ngx.fetch() operation from NGIN…"
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-122
vendor: f5
product: njs
affected:
  - 'njs >= 0.9.4, < 0.9.9'
patched:
  - njs 0.9.9
published: '2026-05-19'
updated: '2026-07-23'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-8711'
references:
  - url: 'https://my.f5.com/manage/s/article/K000161307'
    label: f5sirt@f5.com
tags:
  - nvd
epss: 0.09686
epssPercentile: 0.95289
ingestedAt: '2026-07-23T20:19:19.340Z'
---

## Overview

NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the ngx.fetch() operation from NGINX JavaScript. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

## Affected

- `njs >= 0.9.4, < 0.9.9`

## Remediation

Upgrade past the affected range:

- `njs 0.9.9`