https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 20:48:04 +0000 https://vulnerability.circl.lu/vuln/cve-2026-8711 <p><strong>Affected:</strong> F5 NGINX JavaScript</p> <p>NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the ngx.fetch() operation from NGINX JavaScript. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.</p> <p>Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.</p> <p><strong>Affected:</strong> F5 NGINX JavaScript</p> <p>NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the ngx.fetch() operation from NGINX JavaScript. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.</p> <p>Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.</p> https://vulnerability.circl.lu/vuln/cve-2026-8711 https://vulnerability.circl.lu/vuln/usn-8425-1 <p><strong>Affected:</strong> Ubuntu:Pro:26.04:LTS: libnginx-mod-js</p> <p>It was discovered that njs did not properly handle certain client- controlled variables when processing ngx.fetch() requests. An attacker could possibly use this issue to trigger a heap buffer overflow, resulting in arbitrary code execution or a denial of service.</p> <p><strong>Affected:</strong> Ubuntu:Pro:26.04:LTS: libnginx-mod-js</p> <p>It was discovered that njs did not properly handle certain client- controlled variables when processing ngx.fetch() requests. An attacker could possibly use this issue to trigger a heap buffer overflow, resulting in arbitrary code execution or a denial of service.</p> https://vulnerability.circl.lu/vuln/usn-8425-1