[Pkg-nginx-maintainers] Bug#1137215: libnginx-mod-js: CVE-2026-8711

[Salvatore Bonaccorso]

Source: libnginx-mod-js
Version: 0.9.8-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for libnginx-mod-js.

CVE-2026-8711[0]:
| NGINX JavaScript has a vulnerability when the
| js_fetch_proxy directive is configured with at least one client-
| controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*)
| and a location invoking the ngx.fetch() operation from NGINX
| JavaScript. An unauthenticated attacker can exploit this
| vulnerability by sending crafted HTTP requests. This may cause a
| heap buffer overflow in the NGINX worker process leading to a
| restart. Additionally, for systems with Address Space Layout
| Randomization (ASLR) disabled, code execution is possible.    Note:
| Software versions which have reached End of Technical Support (EoTS)
| are not evaluated.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-8711
    https://www.cve.org/CVERecord?id=CVE-2026-8711
[1] https://my.f5.com/manage/s/article/K000161307

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore