CVE-2026-8711

Name	CVE-2026-8711
Description	NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_, $arg_, $cookie_*) and a location invoking the ngx.fetch() operation from NGINX JavaScript. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1137215

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libnginx-mod-js (PTS)	bookworm	0.7.9-2	fixed
	trixie	0.8.9-1	fixed
	forky, sid	0.9.9-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
libnginx-mod-js	source	bookworm	(not affected)
libnginx-mod-js	source	trixie	(not affected)
libnginx-mod-js	source	(unstable)	0.9.9-1	1137215

Notes

[trixie] - libnginx-mod-js <not-affected> (Vulnerable code not present)
[bookworm] - libnginx-mod-js <not-affected> (Vulnerable code not present)
https://my.f5.com/manage/s/article/K000161307
Introduced with: https://github.com/nginx/njs/commit/dea831892cee6ad3a6e7420e2174157a1a73b92d (0.9.4)
Fixed by:  https://github.com/nginx/njs/commit/2bf4601a94c2a22b715d74e6d92dedb1850d56d3 (0.9.9)