NGINX njs: One Overflow to Crash Them All

Source:

• F5: CVE-2026-8711 - heap buffer overflow in ngx_http_js_module

tldr: CVE-2026-8711 is a heap buffer overflow in NGINX JavaScript (njs) via ngx_http_js_module. It can crash workers and cause denial of service, and in some conditions may allow remote code execution. Similar in nature to the earlier CVE-2026-42945 (NGINX Rift). Fixed in njs 0.9.9.

Affected versions

What to do

• Upgrade NGINX JavaScript (njs) to 0.9.9.
• Review the F5 advisory for environment-specific guidance.
• If you run ngx_http_js_module in production, audit your configuration and monitor worker stability after upgrading.