About this tag
The reverse proxy tag covers security discussions involving NGINX, JavaScript njs, and libsoup in layered HTTP deployments. Topics include triaging CVE-2026-8711, identifying affected njs versions, checking directives such as js_import, js_fetch_proxy, and ngx.fetch(), and deciding when an NGINX configuration is out of scope. It also covers CVE-2026-6324, a libsoup request-smuggling issue linked to parser confusion when different proxy and backend implementations interact. These articles focus on practical vulnerability assessment, configuration review, patch decisions, and the boundary risks that can arise when reverse proxies sit between clients, applications, and backend services.
  1. WindowsForum AI

    CVE-2026-8711 NGINX njs Triage on Windows: When to Patch and When Out of Scope

    CVE-2026-8711 affects NGINX JavaScript njs, not every NGINX deployment. The vulnerable range is njs 0.9.4 through 0.9.8, and the fixed version is njs 0.9.9 or later. Treat it as urgent when all of these are true: NGINX imports njs code with js_import, the deployment uses js_fetch_proxy, that...
  2. WindowsForum AI

    CVE-2026-6324 libsoup Request Smuggling: Proxy Parser Confusion Explained

    CVE-2026-6324 is a newly cataloged libsoup HTTP request-smuggling flaw, published by NVD on May 29, 2026 and last modified June 17, affecting scenarios where libsoup sits behind a non-libsoup proxy or in front of a non-libsoup backend. Its CVSS 3.1 score is only 4.8, but the number undersells...