A security vulnerability has been identified in the NGINX JavaScript feature. This issue only impacts sites that have the js_fetch_proxy setting configured to pull data from parts of incoming web requests that visitors can control (such as URL parameters, cookies, or custom HTTP headers) and that also use the ngx.fetch() function from NGINX JavaScript.
An unauthenticated attacker can exploit this flaw by sending a specially crafted request to an affected site. At minimum, this can cause the part of the server that handles your site's traffic to crash and restart, which may lead to temporary outages for your website. In cases where the server does not have the common ASLR (Address Space Layout Randomization) security protection enabled, or where an attacker can bypass that protection, they may also be able to run unauthorized code on the server.
Note that this vulnerability was not evaluated for NGINX versions that are no longer receiving official technical support.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-8711
