Critical 9.2 CVSS: NGINX JavaScript Module Flaw (CVE-2026-8711) Triggers Heap Buffer Overflows

F5 warns of a critical heap-buffer-overflow in the NGINX JavaScript (njs) module (CVE-2026-8711, CVSS 9.2) that can be triggered when js_fetch_proxy expands client-controlled variables into URLs used by ngx.fetch; an unauthenticated attacker can cause worker crashes (DoS) and, on systems without ASLR, potentially achieve remote code execution. Affected njs versions are 0.9.4–0.9.8 and the issue is fixed in 0.9.9.