A security flaw, tracked as CVE-2026-8711, affects the NGINX JavaScript feature used in many web server setups. This issue only impacts configurations that use the js_fetch_proxy setting paired with visitor-controlled data (such as information from visitor browser headers, URL parameters, or cookies) and also call the ngx.fetch() function from NGINX JavaScript.
An attacker does not need to have an account on your site to exploit this vulnerability. They can send specially crafted requests to trigger the flaw, which can cause the NGINX process that manages your site’s traffic to crash and restart, leading to temporary downtime for your site. In cases where the server’s ASLR security feature (a common protection against certain types of attacks) is disabled, or if an attacker can work around that protection, the flaw could also let them run unauthorized code on the server.
Note that this vulnerability was not assessed for NGINX software versions that have reached their End of Technical Support (EoTS) date.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-8711
