Executive brief
NGINX JavaScript (njs) is a module used to extend NGINX functionality with custom scripts. A vulnerability exists when the module is configured to use proxy settings controlled by user-provided data, such as cookies or URL arguments. An unauthenticated attacker could send a specially crafted request that crashes the NGINX worker process, potentially causing a service outage or, in specific system configurations, allowing the attacker to take control of the server.
Technical details
A heap-based buffer overflow (CWE-122) exists in NGINX JavaScript (njs) when the 'js_fetch_proxy' directive is configured with at least one client-controlled NGINX variable (e.g., $http_*, $arg_*, $cookie_*) and a location invokes the 'ngx.fetch()' operation. An unauthenticated remote attacker can exploit this by sending crafted HTTP requests. The vulnerability results in a heap overflow in the NGINX worker process, typically causing a crash and restart (DoS). On systems where Address Space Layout Randomization (ASLR) is disabled, this overflow may be leveraged for arbitrary code execution. The attack complexity is considered high as it requires specific configuration preconditions.
Affected products
- F5 NGINX JavaScript All versions prior to EoTS (End of Technical Support)
Timeline
- 2026-05-19: advisory: Initial publication of CVE-2026-8711 by F5 and NVD.