Critical NGINX JavaScript Vulnerability (CVE-2026-8711) Enables Remote Code Execution
A newly disclosed vulnerability in NGINX JavaScript (njs), tracked as CVE-2026-8711, exposes systems to severe security risks, including denial-of-service (DoS) attacks and remote code execution (RCE). The flaw stems from a heap-based buffer overflow in the ngx_http_js_module, specifically in how the js_fetch_proxy directive processes client-controlled variables (e.g., $http_host, $uri, or $args) when combined with the () operation in NGINX JavaScript.
Unauthenticated attackers can exploit this vulnerability by sending crafted requests, potentially gaining control over the NGINX worker process. The issue affects configurations where js_fetch_proxy is enabled with user-supplied input, making it a critical concern for organizations relying on NGINX for web traffic management.
No patch has been publicly disclosed at this time, leaving affected deployments vulnerable until mitigations are implemented. The impact extends to environments where NGINX is used as a reverse proxy, load balancer, or web server, particularly in high-traffic or security-sensitive applications. Further details on exploitation conditions and affected versions are expected to emerge as security researchers analyze the flaw.
Source: https://www.linkedin.com/feed/update/urn:li:activity:7462832775725813760
NGINX TPRM report: https://www.rankiteo.com/company/nginx
"id": "ngi1779279820",
"linkid": "nginx",
"type": "Vulnerability",
"date": "5/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'type': 'Organization'}],
'attack_vector': 'Remote',
'description': 'A newly disclosed vulnerability in NGINX JavaScript (njs), '
'tracked as CVE-2026-8711, exposes systems to severe security '
'risks, including denial-of-service (DoS) attacks and remote '
'code execution (RCE). The flaw stems from a heap-based buffer '
'overflow in the ngx_http_js_module, specifically in how the '
'js_fetch_proxy directive processes client-controlled '
'variables (e.g., $http_host, $uri, or $args) when combined '
'with the () operation in NGINX JavaScript. Unauthenticated '
'attackers can exploit this vulnerability by sending crafted '
'requests, potentially gaining control over the NGINX worker '
'process.',
'impact': {'operational_impact': 'Potential denial-of-service (DoS) or remote '
'code execution (RCE)',
'systems_affected': 'NGINX deployments with js_fetch_proxy enabled '
'using client-controlled variables'},
'post_incident_analysis': {'root_causes': 'Heap-based buffer overflow in '
'ngx_http_js_module due to improper '
'handling of client-controlled '
'variables in js_fetch_proxy '
'directive'},
'references': [{'source': 'Vulnerability disclosure'}],
'title': 'Critical NGINX JavaScript Vulnerability (CVE-2026-8711) Enables '
'Remote Code Execution',
'type': 'Vulnerability',
'vulnerability_exploited': 'CVE-2026-8711 (Heap-based buffer overflow in '
'ngx_http_js_module)'}