A security vulnerability has been identified in NGINX JavaScript, a component used in many web server setups. This flaw only affects sites that have the js_fetch_proxy setting configured to use visitor-supplied data (such as URL parameters, cookies, or custom request headers) alongside the ngx.fetch() operation in their NGINX JavaScript code. If your site does not use this specific configuration, you are not impacted by this issue.
An attacker does not need any login or account access to exploit this flaw: they can send specially crafted HTTP requests to trigger it. The most immediate impact is a heap buffer overflow that crashes and restarts the NGINX worker process, the part of the server that handles traffic for your site, which may cause temporary downtime for your website. On servers that do not have Address Space Layout Randomization (ASLR, a common security feature) enabled, or if an attacker can bypass ASLR, the flaw could also let attackers run unauthorized code on the server.
Note that this vulnerability was not evaluated for versions of the affected software that have reached their End of Technical Support, so those older, unsupported versions may also be at risk.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-8711
