CVE-2026-8711
NGINX JavaScript can crash when the js_fetch_proxy directive is set with client‑controlled variables such as $http_*, $arg_*, or $cookie_*. An attacker can send crafted requests that trigger a heap buffer overflow, causing the NGINX worker process to restart. If Address Space Layout Randomization is disabled or bypassed, the attacker may also execute arbitrary code.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
NGINX JavaScript (f5 njs) configurations that use the js_fetch_proxy directive with client‑controlled variables. Administrators who enable this feature on their NGINX servers are affected.
Real-world impact
An attacker can cause a denial‑of‑service by crashing the NGINX worker process. With ASLR disabled or bypassed, the attacker could also run arbitrary code on the affected server, potentially taking full control.
Why this severity
The CVSS score of 9.2 reflects the high impact of a heap buffer overflow that can lead to code execution, combined with the fact that the vulnerability is network‑exposed, requires no authentication, and has a high exploitability score.
What to do about it
- ›Avoid using the js_fetch_proxy directive with client‑controlled variables; disable or remove the directive if possible.
- ›Consider disabling NGINX JavaScript entirely if it is not required for your application.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- May 19, 2026 · May 19, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- my.f5.com/manage/s/article/K000161307vendor advisory