CVE-2026-8711
NGINX JavaScript has a vulnerability when the js_fetch_proxydirective ...
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Azure Linux (hoch), Ubuntu (mittel).
Beschreibung
NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the ngx.fetch() operation from NGINX JavaScript. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| alpine 3.24 | nginx, njs | 1.30.2-r1 und 1 weitere |
| alpine edge | nginx, njs | 1.30.2-r1 und 1 weitere |
| Azure Linux 3.0 | nginx | 0:1.28.3-3.azl3 |
| debian 14 | libnginx-mod-js | 0.9.9-1 |
| rapidfort alpine 3.20 | nginx, njs | 1.29.1-r1, 1.30.2-r1 und 1 weitere |
| rapidfort alpine 3.21 | nginx, njs | 1.29.1-r1, 1.30.2-r1 und 1 weitere |
| rapidfort alpine 3.22 | nginx, njs | 1.29.1-r1, 1.30.2-r1 und 1 weitere |
| rapidfort alpine 3.23 | nginx, njs | 1.29.1-r1, 1.30.2-r1 und 1 weitere |
| rapidfort alpine 3.24 | nginx, njs | 1.29.1-r1, 1.30.2-r1 und 1 weitere |
| rapidfort debian 12 | libnginx-mod-js | 0:0.9.9-1 |
| rapidfort debian 13 | libnginx-mod-js | 0:0.9.9-1 |
| ubuntu 26.04 | libnginx-mod-js | kein Fix angegeben |
Alle 19 Einträge aus 12 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| alpine 3.24 | nginx | 1.30.2-r1 |
| alpine 3.24 | njs | 0.9.9-r0 |
| alpine edge | nginx | 1.30.2-r1 |
| alpine edge | njs | 0.9.9-r0 |
| Azure Linux 3.0 | nginx | 0:1.28.3-3.azl3 |
| debian 14 | libnginx-mod-js | 0.9.9-1 |
| rapidfort alpine 3.20 | nginx | 1.29.1-r1, 1.30.2-r1 |
| rapidfort alpine 3.20 | njs | 0.9.9-r0 |
| rapidfort alpine 3.21 | nginx | 1.29.1-r1, 1.30.2-r1 |
| rapidfort alpine 3.21 | njs | 0.9.9-r0 |
| rapidfort alpine 3.22 | nginx | 1.29.1-r1, 1.30.2-r1 |
| rapidfort alpine 3.22 | njs | 0.9.9-r0 |
| rapidfort alpine 3.23 | nginx | 1.29.1-r1, 1.30.2-r1 |
| rapidfort alpine 3.23 | njs | 0.9.9-r0 |
| rapidfort alpine 3.24 | nginx | 1.29.1-r1, 1.30.2-r1 |
| rapidfort alpine 3.24 | njs | 0.9.9-r0 |
| rapidfort debian 12 | libnginx-mod-js | 0:0.9.9-1 |
| rapidfort debian 13 | libnginx-mod-js | 0:0.9.9-1 |
| ubuntu 26.04 | libnginx-mod-js | kein Fix angegeben |