Brief Summary: CVE-2026-8711 Heap Buffer Overflow in NGINX JavaScript (njs) via js_fetch_proxy

Introduction

A heap buffer overflow in the NGINX JavaScript module lets unauthenticated remote attackers crash NGINX worker processes, and potentially achieve code execution, by sending crafted HTTP requests to endpoints that use the js_fetch_proxy directive with client-controlled variables. NGINX powers 32.4 percent of all websites with a known web server, so even a vulnerability limited to one module configuration deserves close attention from operations and security teams.

The two published scores disagree. The NVD rates CVE-2026-8711 at CVSS 3.1 8.1 (High), while F5 themselves rate it at CVSS 4.0 9.2 (Critical). The vendor also states plainly that no workarounds exist, so upgrading is the only fix.

Technical Information

Root Cause

CVE-2026-8711 is a heap-based buffer overflow (CWE-122) in the ngx_http_js_module component of NGINX JavaScript (njs). The flaw is strictly a data plane issue with no control plane exposure.

The overflow requires both of these conditions in the NGINX configuration at the same time:

1. The js_fetch_proxy directive is configured with at least one NGINX variable that a client can control, such as $http_*, $arg_*, or $cookie_*.
2. A location block invokes the ngx.fetch() operation from JavaScript code.

When both are present, njs expands client-supplied data into the proxy URL as it builds it, without adequate bounds checking. A crafted HTTP request can supply variable content that overflows the heap buffer allocated for the URL and corrupts adjacent memory in the NGINX worker process.

Vulnerable Configuration

F5 provided the following example of a vulnerable configuration in their advisory:

server {
    listen 127.0.0.1:8080;
    server_name localhost;
    location / {
        # Client controlled variable expansion into URL contents
        # Example below x-user and x-password headers are used to construct the proxy URL
        # main.fetcher is a JavaScript function defined in the js file that calls ngx.fetch with the constructed URL
        js_fetch_proxy http://$http_x_user:[email protected]:3128;
        js_content main.fetcher;
    }
}

Here the $http_x_user and $http_x_password variables come directly from client-supplied HTTP headers (X-User and X-Password), so the attacker fully controls their content.

Attack Flow

1. The attacker finds an NGINX endpoint that uses js_fetch_proxy with client-controlled variables (e.g., custom headers, query parameters, or cookies).
2. The attacker sends an HTTP request with oversized or specially structured values in the controlled headers (or other variable sources).
3. The NGINX JavaScript module expands these values into the proxy URL during the ngx.fetch() operation.
4. The expansion overflows the heap buffer allocated for the URL and corrupts adjacent heap memory.
5. In the default case (ASLR enabled), the NGINX worker process crashes and restarts, which causes a denial of service.
6. On systems where ASLR is disabled, the attacker may be able to control the overwritten heap metadata or adjacent objects and achieve arbitrary code execution.

The attack needs no authentication and no special privileges. The ability to send HTTP requests to the vulnerable endpoint is enough.

Severity Scoring Discrepancy

The NVD assigns a CVSS 3.1 score of 8.1 (High), while F5 assigns a CVSS 4.0 score of 9.2 (Critical). Security teams should weigh the vendor's assessment alongside the NVD score when prioritizing remediation, particularly because F5 has the most detailed understanding of the affected code path.

Affected Systems and Versions

The vulnerable configuration requires both the js_fetch_proxy directive with client-controlled NGINX variables and a location block that invokes ngx.fetch(). Deployments that do not use this pattern in their njs configuration are not exploitable, even if they run a vulnerable njs version.

F5 did not evaluate software versions that have reached End of Technical Support (EoTS).

Vendor Security History

F5 responded quickly. It published the security advisory (K000161307) on May 19, 2026, the same day the CVE was published. The advisory is thorough in scope. It clearly identifies affected and unaffected products, gives a vulnerable configuration example, and confirms that no workarounds exist. The researcher udolemi of S2W discovered the vulnerability and reported it through coordinated disclosure.

References

• F5 Advisory K000161307: NGINX ngx_http_js_module vulnerability CVE-2026-8711
• NVD Entry for CVE-2026-8711
• NGINX vs. Apache vs. Microsoft IIS usage statistics, May 2026
• NGINX Wikipedia Entry
• F5 Completes Acquisition of NGINX Press Release