CVE-2026-8711
NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the ngx.fetch() operation from NGINX JavaScript. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Exploitation Probability (EPSS)
Low PriorityThe Exploit Prediction Scoring System (EPSS) uses machine learning to estimate the probability that a vulnerability will be exploited in the wild within the next 30 days.
7-Day Exploitation Trend
Vulnerability Timeline
2 eventsThreat Actor Attribution
PREMIUM INTELRemediation & Mitigation
SOLUTIONOfficial patches and mitigation steps are available for this vulnerability.
apt-get update && apt-get upgrade -y specific-package
# Verify installation
dpkg -l | grep package-name
Am I Vulnerable?
Check your domain or package.json for CVE-2026-8711 exposure.
Vulnerability Details
Need Manual Validation?
Automated scanners flag false positives. Get a manual pentest validation for this CVE.