Which versions of NGINX JavaScript are affected by CVE-2026-8711?

F5 NGINX JavaScript module versions 0.9.4 through 0.9.8 contain a critical vulnerability allowing unauthenticated remote attackers to crash web services and potentially execute code on affected…. A patch is available.

How to fix or mitigate CVE-2026-8711?

Within 24 hours: Identify all NGINX deployments using njs module versions 0.9.4-0.9.8 with js_fetch_proxy directive enabled. Within 7 days: Deploy F5-released security patch to all affected NGINX installations. Within 30 days: Complete patch validation, regression testing, and document remediation across all systems.

NGINX JavaScript CVE-2026-8711

Q: What is the CVSS score of CVE-2026-8711?

CVE-2026-8711 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-30940 CRITICAL

Heap-based Buffer Overflow (CWE-122)

2026-05-19 f5

GHSA-pj32-6rxc-gcmq

RCE Buffer Overflow Nginx Heap Overflow

9.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 19, 2026 - 15:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 19, 2026 - 15:22 vuln.today

cvss_changed

Severity Changed

May 19, 2026 - 15:22 NVD

HIGH CRITICAL

CVSS changed

May 19, 2026 - 15:22 NVD

8.1 (HIGH) 9.2 (CRITICAL)

Patch available

May 19, 2026 - 15:02 EUVD

Analysis Generated

May 19, 2026 - 15:01 vuln.today

DescriptionCVE.org

NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the ngx.fetch() operation from NGINX JavaScript. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, for systems with Address Space Layout Randomization (ASLR) disabled, code execution is possible.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Heap buffer overflow in F5 NGINX JavaScript (njs) module versions 0.9.4 through 0.9.8 allows unauthenticated remote attackers to crash NGINX worker processes, with potential remote code execution on hosts where ASLR is disabled. Exploitation requires the deployment to use the js_fetch_proxy directive with at least one client-controlled NGINX variable (such as $http_*, $arg_*, or $cookie_*) and a location that invokes ngx.fetch(). No public exploit identified at time of analysis, but a vendor patch is available and the CVSS 4.0 base score of 9.2 reflects the high impact across confidentiality, integrity, and availability.

Technical ContextAI

NGINX JavaScript (njs) is F5's scripting engine that embeds JavaScript into the NGINX configuration, allowing administrators to write request-handling logic and outbound subrequests via the ngx.fetch() API. The js_fetch_proxy directive configures an upstream proxy URL used for those subrequests; when its value interpolates a client-controlled NGINX variable, the parser appears to mishandle attacker-supplied content during proxy URL construction. The root cause is classified as CWE-122 (heap-based buffer overflow), meaning attacker bytes overrun an allocation on the heap inside the NGINX worker process. The affected CPE is cpe:2.3:a:f5:nginx_javascript across the version range 0.9.4 up to (but not including) 0.9.9.

RemediationAI

Upgrade the NGINX JavaScript module to version 0.9.9 or later, which is the first release outside the affected 0.9.4-0.9.8 range per F5 advisory K000161307 (https://my.f5.com/manage/s/article/K000161307). If immediate patching is not possible, the most direct compensating control is to remove client-controlled NGINX variables ($http_*, $arg_*, $cookie_*) from any js_fetch_proxy directive value and instead use static or server-controlled values, which eliminates the attack surface but reduces flexibility for dynamic upstream selection. Alternatively, temporarily disable the affected location blocks that call ngx.fetch() under a js_fetch_proxy with dynamic variables - this breaks the affected proxy functionality but stops the attack path. Ensure ASLR remains enabled on the host (the Linux default), which downgrades a successful exploit from code execution to a worker restart while a patch is being rolled out.