A vulnerability has been identified in NGINX JavaScript that only affects websites configured to use the js_fetch_proxy setting tied to user-controlled parts of incoming requests (such as request headers, URL parameters, or cookies) and that also use the ngx.fetch() function in their NGINX JavaScript code.
Unauthenticated attackers can exploit this flaw by sending specially crafted HTTP requests to affected sites, with no need for login credentials or account access to launch an attempt.
In most cases, this will cause the part of the server that handles your site traffic to crash and restart, leading to temporary downtime for your website. On servers that do not have a common security feature called Address Space Layout Randomization (ASLR) enabled, or if an attacker can bypass that feature, they may also be able to run unauthorized code on the server. Software versions that have passed their End of Technical Support are not evaluated for this vulnerability.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-8711
