AZL-87117
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-87117.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-87117
- Upstream
- Published
- 2026-05-19T15:16:33Z
- Modified
- 2026-08-30T05:26:50Z
- Summary
- CVE-2026-8711 affecting package nginx for versions less than 1.28.3-4
- Details
-
NGINX JavaScript has a vulnerability when the jsfetchproxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the ngx.fetch() operation from NGINX JavaScript. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- References