Attack Chain

1. An attacker crafts a malicious HTTP request containing specially crafted data within headers, arguments, or cookies.
2. The attacker sends the crafted HTTP request to the targeted NGINX server.
3. NGINX receives the request and processes it according to the server configuration.
4. The js_fetch_proxy directive is triggered due to the request matching a configured location.
5. The ngx.fetch() operation is invoked from the NGINX JavaScript code within the triggered location.
6. The JavaScript code utilizes a client-controlled NGINX variable (e.g., $http_*, $arg_*, $cookie_*) as part of the ngx.fetch() operation’s configuration or parameters.
7. Due to insufficient input validation or sanitization, the crafted data from the client-controlled variable causes a heap buffer overflow during the processing of the ngx.fetch() operation.
8. The heap buffer overflow corrupts memory within the NGINX worker process, leading to a process restart, or, with ASLR disabled, potentially code execution.

Impact

Successful exploitation of this vulnerability can lead to a denial-of-service condition due to the NGINX worker process restarting. On systems with ASLR disabled, successful exploitation can lead to arbitrary code execution, potentially allowing the attacker to gain full control of the affected system. The scope of impact depends on the specific configuration of NGINX and the JavaScript code used.

Recommendation

• Apply the necessary patch or upgrade to the latest version of NGINX JavaScript to remediate CVE-2026-8711.
• Review NGINX configurations to identify instances where the js_fetch_proxy directive is used with client-controlled variables and ngx.fetch(). Implement robust input validation and sanitization to mitigate potential buffer overflows.
• Enable Address Space Layout Randomization (ASLR) on systems running NGINX to mitigate the risk of code execution in the event of a successful buffer overflow.
• Deploy the Sigma rules provided below to detect exploitation attempts targeting CVE-2026-8711.
• Monitor NGINX logs for unusual HTTP requests containing potentially malicious payloads in headers, arguments, or cookies that are being used with the vulnerable directive (see example requests in positive tests below).