A security vulnerability has been identified in the NGINX JavaScript feature that only impacts specific website configurations. The flaw exists if your site uses the js_fetch_proxy setting configured to pull in visitor-controlled data such as request headers, URL parameters, or cookies, and also uses the ngx.fetch() operation from NGINX JavaScript. Sites without this exact configuration are not affected by this issue, and versions of NGINX that have reached End of Technical Support were not assessed for this vulnerability.
Unauthenticated attackers could send specially crafted HTTP requests to exploit this flaw. This may cause the process running your website to crash and restart, and in some cases, attackers may be able to run unauthorized code on the server, particularly if the server does not have standard security protections like Address Space Layout Randomization (ASLR) enabled.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-8711
