We are sharing information about a recently disclosed security flaw in the NGINX JavaScript tool, which some websites use to run custom server-side scripting functions. This issue only impacts sites that use two specific features in combination: the js_fetch_proxy configuration that is set to use variables controlled by website visitors (such as data from request headers, URL parameters, or cookies) and the ngx.fetch() operation from NGINX JavaScript. If your site does not use both of these features together, it is not affected by this flaw.
An unauthenticated attacker (meaning they do not need a login or existing access to your site) can exploit this flaw by sending specially crafted requests to your website. In most cases, this will cause a memory-related crash in the website’s backend process, leading to temporary service interruptions while the process automatically restarts. For servers that do not have the common Address Space Layout Randomization (ASLR) security feature enabled, or if an attacker is able to bypass that feature, they may also be able to run unauthorized malicious code on your server.
Note that this assessment does not cover NGINX versions that have reached their End of Technical Support (EoTS).
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-8711
