A recently identified vulnerability in NGINX JavaScript, known as CVE‑2026‑8711, poses significant security threats. This flaw enables remote attackers to exploit a heap-based buffer overflow, potentially causing denial-of-service or even remote code execution within the NGINX worker process.
Understanding the Vulnerability
The issue is linked to the js_fetch_proxy directive’s handling of client-controlled variables alongside the ngx.fetch() method in NGINX JavaScript. The vulnerability emerges within the ngx_http_js_module, particularly when js_fetch_proxy is set up with variables controlled by clients.
When these variables are manipulated in a specific way, an attacker can send specially crafted HTTP requests that cause a heap buffer overflow, disrupting the NGINX worker process. This flaw is classified under CWE‑122: Heap-based Buffer Overflow, and it has been documented internally by F5 as ID 160 for NGINX Plus and NGINX OSS.
Impact and Exploitation Risks
This buffer overflow primarily leads to crashes in worker processes, triggering automatic restarts and creating a denial-of-service condition in the NGINX data plane. In environments where Address Space Layout Randomization (ASLR) is either disabled or improperly configured, this vulnerability could allow arbitrary code execution.
The affected versions range from NGINX JavaScript 0.9.4 to 0.9.8, with a resolution provided in version 0.9.9. The vulnerability specifically impacts the ngx_http_js_module, which employs NJS-based directives like js_content and js_fetch_proxy. A typical attack pattern involves manipulating client-supplied headers to construct proxy URLs, leading to heap memory corruption.
Recommended Actions for Administrators
According to F5’s advisory K000161307, this issue affects the data plane exclusively and does not compromise the control plane. Other F5 products, including BIG‑IP, BIG‑IQ, and others, remain unaffected by CVE‑2026‑8711.
Administrators using vulnerable njs versions should promptly upgrade to NGINX JavaScript 0.9.9 or a later version. If immediate upgrades are not feasible, configurations involving js_fetch_proxy with client-controlled variables should be reviewed and adjusted. Additionally, enabling ASLR on all NGINX hosts is crucial to thwart potential code execution attempts.
Stay informed on the latest updates by following us on Google News, LinkedIn, and X.
