Critical NGINX Vulnerability CVE-2024-35200 Lets Attackers Inject Malicious Code

Key Takeaways

• A critical heap-based buffer overflow vulnerability (CVE-2026-8711) has been discovered in NGINX JavaScript (njs).
• The flaw affects njs versions 0.9.4 through 0.9.8, primarily impacting the ngx_http_js_module.
• Unauthenticated remote attackers can exploit this vulnerability to cause denial-of-service or, under specific conditions, achieve remote code execution.
• A fix is available in NGINX JavaScript version 0.9.9, and immediate upgrade is strongly recommended.

A significant security flaw, identified as CVE-2026-8711, has been uncovered in NGINX JavaScript (njs), posing a substantial risk to affected deployments. This vulnerability enables unauthenticated remote attackers to trigger a heap-based buffer overflow, which can lead to a denial-of-service condition or, in more severe scenarios, remote code execution within the NGINX worker process.

The core of the issue lies in the interaction between the js_fetch_proxy directive and the ngx.fetch() operation within NGINX JavaScript, specifically when client-controlled variables are used. This vulnerability is formally classified as CWE-122: Heap-based Buffer Overflow and is tracked by F5 internally as ID 160 for NGINX Plus and NGINX OSS.

Technical Details of the Vulnerability

The exploit arises within the ngx_http_js_module when the js_fetch_proxy directive is configured to include at least one client-controlled NGINX variable, such as $uri, $request_uri, or $host. If a location then calls an NJS function that subsequently invokes ngx.fetch(), a malicious actor can craft specific HTTP requests. These requests are designed to corrupt heap memory, resulting in a buffer overflow within the NGINX worker process.

While the primary outcome of this defect is the crashing and automatic restarting of worker processes, effectively creating a denial-of-service (DoS) state on the NGINX data plane, the threat can escalate. On systems where Address Space Layout Randomization (ASLR) is either disabled or improperly configured, the buffer overflow becomes exploitable for arbitrary code execution within the worker’s context.

The vulnerability specifically impacts NGINX JavaScript (njs) versions ranging from 0.9.4 to 0.9.8. The critical fix for this issue was introduced in njs version 0.9.9. The affected component is the ngx_http_js_module, which is responsible for exposing NJS-based HTTP processing directives like js_content and js_fetch_proxy.

A common vulnerable configuration pattern involves js_fetch_proxy constructing a proxy URL using client-supplied headers, for example, $http_x_user and $http_x_password. Concurrently, js_content points to an NJS function (e.g., main.fetcher) that calls ngx.fetch() with that dynamically generated URL. In such a setup, an attacker can manipulate these header values to corrupt heap memory in the NGINX worker, causing repeated crashes.

F5 has confirmed in article K000161307 that this vulnerability is confined to the data plane and does not extend to the control plane. Furthermore, other F5 products and services, including BIG-IP, BIG-IQ, BIG-IP Next, F5OS, and F5 Distributed Cloud services, have been evaluated and are reported not to be vulnerable to CVE-2026-8711 in their current versions.

What You Should Do

• Upgrade NGINX JavaScript: The primary and most effective remediation is to upgrade NGINX JavaScript (njs) to version 0.9.9 or later immediately.
• Review Configurations: If an immediate upgrade is not feasible, scrutinize NGINX configurations for any use of js_fetch_proxy combined with client-controlled variables (e.g., $uri, $request_uri, $host, or client-supplied headers like $http_x_user). Refactor or remove these patterns to eliminate the vulnerability.
• Enable ASLR: Ensure that Address Space Layout Randomization (ASLR) is fully enabled and properly configured on all NGINX hosts. While not a direct fix for the overflow, ASLR significantly complicates the exploitation of buffer overflows for remote code execution.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.