NGINX JavaScript becomes vulnerable when the js_fetch_proxy directive is configured with any client‑controlled variable such as $http_*, $arg_*, or $cookie_* while a location uses the ngx.fetch() operation. This induces a heap buffer overflow in the worker process, which can trigger a restart. For deployments with Address Space Layout Randomization disabled, the same flaw can lead to arbitrary code execution.

The vulnerability impacts the NGINX JavaScript engine supplied by F5. No specific affected product versions are listed in the available data, so any installation using the js_fetch_proxy directive with client‑controlled variables is potentially at risk.

The CVSS score of 9.2 indicates a high severity. Attackers can reach the flaw from outside the system by sending crafted HTTP requests, making it a remote unauthenticated vulnerability. The EPSS score is not available and the flaw is not listed in CISA’s KEV catalog, but the lack of mitigations such as ASLR greatly increases the exploit likelihood. Given the potential for immediate denial of service and conditional code execution, the risk remains high.