A vulnerability affects the NGINX JavaScript feature, but only for setups that use the js_fetch_proxy setting with user-controlled NGINX variables (these include variables tied to visitor-provided data like HTTP headers, URL arguments, or cookies) and have website locations that use the ngx.fetch() operation from NGINX JavaScript.
Unauthenticated attackers can exploit this flaw by sending specially crafted HTTP requests. This can trigger a heap buffer overflow in the NGINX worker process that runs your website, causing the process to crash and restart, which may lead to temporary site downtime.
In rare cases, if the server does not have the common security feature Address Space Layout Randomization (ASLR) enabled, or if an attacker is able to bypass this security feature, attackers may also be able to run unauthorized code on the server. Please note that NGINX versions that have reached End of Technical Support were not assessed as part of this evaluation.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-8711
