CVE-2026-8711
NGINX JavaScript has a vulnerability when the js_fetch_proxydirective ...
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Azure Linux (high), Ubuntu (medium).
Description
NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the ngx.fetch() operation from NGINX JavaScript. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.24 | nginx, njs | 1.30.2-r1 and 1 more |
| alpine edge | nginx, njs | 1.30.2-r1 and 1 more |
| Azure Linux 3.0 | nginx | 0:1.28.3-3.azl3 |
| debian 14 | libnginx-mod-js | 0.9.9-1 |
| rapidfort alpine 3.20 | nginx, njs | 1.29.1-r1, 1.30.2-r1 and 1 more |
| rapidfort alpine 3.21 | nginx, njs | 1.29.1-r1, 1.30.2-r1 and 1 more |
| rapidfort alpine 3.22 | nginx, njs | 1.29.1-r1, 1.30.2-r1 and 1 more |
| rapidfort alpine 3.23 | nginx, njs | 1.29.1-r1, 1.30.2-r1 and 1 more |
| rapidfort alpine 3.24 | nginx, njs | 1.29.1-r1, 1.30.2-r1 and 1 more |
| rapidfort debian 12 | libnginx-mod-js | 0:0.9.9-1 |
| rapidfort debian 13 | libnginx-mod-js | 0:0.9.9-1 |
| ubuntu 26.04 | libnginx-mod-js | no fix listed |
Show all 19 entries from 12 sources
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.24 | nginx | 1.30.2-r1 |
| alpine 3.24 | njs | 0.9.9-r0 |
| alpine edge | nginx | 1.30.2-r1 |
| alpine edge | njs | 0.9.9-r0 |
| Azure Linux 3.0 | nginx | 0:1.28.3-3.azl3 |
| debian 14 | libnginx-mod-js | 0.9.9-1 |
| rapidfort alpine 3.20 | nginx | 1.29.1-r1, 1.30.2-r1 |
| rapidfort alpine 3.20 | njs | 0.9.9-r0 |
| rapidfort alpine 3.21 | nginx | 1.29.1-r1, 1.30.2-r1 |
| rapidfort alpine 3.21 | njs | 0.9.9-r0 |
| rapidfort alpine 3.22 | nginx | 1.29.1-r1, 1.30.2-r1 |
| rapidfort alpine 3.22 | njs | 0.9.9-r0 |
| rapidfort alpine 3.23 | nginx | 1.29.1-r1, 1.30.2-r1 |
| rapidfort alpine 3.23 | njs | 0.9.9-r0 |
| rapidfort alpine 3.24 | nginx | 1.29.1-r1, 1.30.2-r1 |
| rapidfort alpine 3.24 | njs | 0.9.9-r0 |
| rapidfort debian 12 | libnginx-mod-js | 0:0.9.9-1 |
| rapidfort debian 13 | libnginx-mod-js | 0:0.9.9-1 |
| ubuntu 26.04 | libnginx-mod-js | no fix listed |