CVE-2026-8711
published 2026-05-19CVE-2026-8711: NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*…
PriorityP266critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.89%
54.8th percentile
NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the ngx.fetch() operation from NGINX JavaScript. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| f5 | nginx_javascript | >= 0.9.4 < 0.9.9 | 0.9.9 |
| f5 | njs | >= 0.9.4 < 0.9.9 | 0.9.9 |
| ubuntu | libnginx-mod-js | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Trigger condition: js_fetch_proxy directive configured with a client-controlled NGINX variable (e.g., $http_*, $arg_*, $cookie_*) AND a location invoking ngx.fetch() — crafted HTTP requests to such an endpoint are the attack vector. ↗
- →Monitor NGINX worker process for unexpected crashes/restarts, which may indicate heap buffer overflow exploitation attempts against this vulnerability. ↗
- →Higher-severity impact (RCE) on systems with ASLR disabled or where ASLR can be bypassed; prioritize patching or ASLR enforcement on affected NGINX hosts. ↗
- ·Vulnerability is only exploitable when js_fetch_proxy is configured with at least one client-controlled NGINX variable (e.g., $http_*, $arg_*, $cookie_*) AND a location block invokes ngx.fetch() via NGINX JavaScript. Configurations not meeting both conditions are not affected. ↗
- ·Software versions that have reached End of Technical Support (EoTS) are not evaluated for this CVE. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.2CRITICALCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
njs vulnerability
vendor_ubuntu·2026-06-11
CVE-2026-8711 njs vulnerability
Title: njs vulnerability
Summary: njs could be made to crash or run programs if it received a specially
crafted input.
It was discovered that njs did not properly handle certain client-
controlled variables when processing ngx.fetch() requests. An attacker
could possibly use this issue to trigger a heap buffer overflow, resulting
in arbitrary code execution or a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
F5
CVE-2026-8711: NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-control...
vendor_f5·2026-05-19·CVSS 9.2
CVE-2026-8711 [CRITICAL] CWE-122 CVE-2026-8711: NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-control...
CVE-2026-8711: NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-control...
NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the ngx.fetch() operation from NGINX JavaScript. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, for systems with Address Space Layout Randomization (ASLR) disabled, code execution is possible.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
F5 Advisory Articles: K0
VulDB
F5 NGINX JavaScript up to 0.9.8 HTTP ngx.fetch heap-based overflow (K000161307)
vuldb·2026-05-19·CVSS 9.2
CVE-2026-8711 [CRITICAL] F5 NGINX JavaScript up to 0.9.8 HTTP ngx.fetch heap-based overflow (K000161307)
A vulnerability, which was classified as critical, was found in F5 NGINX JavaScript up to 0.9.8. Impacted is the function ngx.fetch of the component HTTP Handler. Such manipulation leads to heap-based buffer overflow.
This vulnerability is listed as CVE-2026-8711. The attack may be performed from remote. There is no available exploit.
You should upgrade the affected component.
GHSA
GHSA-pj32-6rxc-gcmq: NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example,
ghsa_unreviewed·2026-05-19
CVE-2026-8711 [CRITICAL] CWE-122 GHSA-pj32-6rxc-gcmq: NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example,
NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the ngx.fetch() operation from NGINX JavaScript. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, for systems with Address Space Layout Randomization (ASLR) disabled, code execution is possible.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-19
Published