CVE-2026-8711

CriticalCVSS 9.8/10Last modified Jul 23, 2026

Description

NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the ngx.fetch() operation from NGINX JavaScript. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

No affected versions have been published.

Timeline

Published: May 19, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-871105.3An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work CVE-2026-871117.2The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to St CVE-2026-871136.3Tanium addressed an improper access controls vulnerability in Threat Response.CVE-2026-871147.1A flaw was found in kube-compare. When processing a 'container://' reference path, the tool incorrectly executes an untrusted container imag CVE-2026-871159.1The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path va CVE-2026-871166.5Tanium addressed a server-side request forgery vulnerability in Threat Response.CVE-2026-871178.7NULL pointer dereference vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recom CVE-2026-871185.7The Botslab G980H dash camera firmware contains an out of bounds write vulnerability in its command processing functionality. An authenticat CVE-2026-871198.2Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge th CVE-2026-87128.3Wyoming before 1.10.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers with network access to forc CVE-2026-871219.8lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device.CVE-2026-871235.9hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping when an async helpe