A security vulnerability has been identified in NGINX JavaScript that only affects sites using the js_fetch_proxy setting configured with at least one client-controlled NGINX variable (such as values from HTTP headers, URL arguments, or cookies) alongside a location that calls the ngx.fetch() operation.
This flaw can be exploited by unauthenticated attackers sending specially crafted HTTP requests to your site. The most immediate impact is a crash of the NGINX worker process that handles your website traffic, which will cause the process to restart and may lead to temporary downtime for your site.
On servers where the common security feature Address Space Layout Randomization (ASLR) is disabled, or if an attacker is able to bypass ASLR, they may also be able to run unauthorized code on your server, creating additional risk for your site and its data. Note that this advisory does not cover NGINX versions that have reached the end of their technical support period.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-8711
