A security vulnerability has been identified in NGINX JavaScript, a feature some websites use to add custom request-handling functionality. This flaw only impacts sites that meet two specific configuration requirements: the js_fetch_proxy setting is configured to use at least one value pulled from visitor-controlled data (such as request headers, URL parameters, or cookies), and the site's code calls the ngx.fetch() operation from NGINX JavaScript in that same setup.
If your site meets these conditions, an unauthenticated attacker (someone who does not need login credentials or prior access to your site) can exploit the flaw by sending specially crafted HTTP requests to your site. The most immediate impact is a heap buffer overflow in the NGINX worker process that handles your site's traffic, which will cause that process to restart and temporarily make your site unavailable to visitors.
In certain scenarios, the risk is more severe. If the server your site runs on has Address Space Layout Randomization (ASLR, a common cybersecurity feature) disabled, or if an attacker is able to bypass ASLR, they may be able to run unauthorized code on the server.
Software versions that have reached their End of Technical Support (EoTS) were not evaluated for this vulnerability.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-8711
