Is CVE-2026-8711 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8711 being exploited in the wild.

How severe is CVE-2026-8711?

High severity, with a CVSS score of 8.1, published 19 May 2026.

Which products and versions are affected?

F5 NGINX JavaScript All versions prior to EoTS (End of Technical Support).

Is there a fix for CVE-2026-8711?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8711 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-8711?

Check whether you run F5 NGINX JavaScript at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8711: F5 NGINX JavaScript heap buffer overflow in js_fetch_proxy

CVE-2026-8711 · Severity: high · CVSS 8.1 · Published 2026-05-19

NGINX JavaScript (njs) is a module used to extend NGINX functionality with custom scripts. A vulnerability exists when the module is configured to use proxy settings controlled by user-provided data, such as cookies or URL arguments. An unauthenticated attacker could send a specially crafted request that crashes the NGINX worker process, potentially causing a service outage or, in specific system configurations, allowing the attacker to take control of the server.

Vendors: F5.

Quick answers

Is CVE-2026-8711 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8711 being exploited in the wild.
How severe is CVE-2026-8711?: High severity, with a CVSS score of 8.1, published 19 May 2026.
Which products and versions are affected?: F5 NGINX JavaScript All versions prior to EoTS (End of Technical Support).
Is there a fix for CVE-2026-8711?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8711 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-8711?: Check whether you run F5 NGINX JavaScript at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow (CWE-122) exists in NGINX JavaScript (njs) when the 'js_fetch_proxy' directive is configured with at least one client-controlled NGINX variable (e.g., $http_*, $arg_*, $cookie_*) and a location invokes the 'ngx.fetch()' operation. An unauthenticated remote attacker can exploit this by sending crafted HTTP requests. The vulnerability results in a heap overflow in the NGINX worker process, typically causing a crash and restart (DoS). On systems where Address Space Layout Randomization (ASLR) is disabled, this overflow may be leveraged for arbitrary code execution. The attack complexity is considered high as it requires specific configuration preconditions.

Affected products

F5 NGINX JavaScript All versions prior to EoTS (End of Technical Support)

Timeline

2026-05-19: advisory: Initial publication of CVE-2026-8711 by F5 and NVD.

References

https://my.f5.com/manage/s/article/K000161307

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.