cve-2026-8711

CVE-2026-8711 affects NGINX JavaScript njs, not every NGINX deployment. The vulnerable range is njs 0.9.4 through 0.9.8, and the fixed version is njs 0.9.9 or later. Treat it as urgent when all of these are true: NGINX imports njs code with js_import, the deployment uses js_fetch_proxy, that...

CVE-2026-8711 is a high-severity NGINX JavaScript vulnerability disclosed in May 2026 that can let an unauthenticated network attacker crash NGINX worker processes when js_fetch_proxy uses client-controlled variables and JavaScript handlers call ngx.fetch(). The headline risk is denial of...