A vulnerability has been identified in NGINX JavaScript that only impacts sites with specific configuration settings. The flaw affects setups where the js_fetch_proxy directive is set to use at least one NGINX variable that pulls data from user input (such as HTTP headers, URL parameters, or cookies) and also calls the ngx.fetch() function from NGINX JavaScript.
An unauthenticated attacker can exploit this issue by sending specially crafted HTTP requests to an affected site. This can trigger a heap buffer overflow in the NGINX worker process that handles your site’s traffic, causing that process to crash and restart, which may lead to brief, unplanned downtime for your site.
In rare cases where the server’s Address Space Layout Randomization (ASLR) security feature is disabled, or if an attacker can bypass ASLR, this vulnerability could also allow the attacker to run unauthorized code on the server. Note that NGINX versions that have reached their end of technical support are not evaluated for this flaw.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-8711
