NGINX JavaScript becomes vulnerable when the js_fetch_proxy directive is configured with one or more client‑controlled variables such as $http_*, $arg_*, or $cookie_* while a location uses the ngx.fetch() operation. An unauthenticated attacker can send crafted HTTP requests that trigger a heap buffer overflow in the worker process, potentially causing a restart. If Address Space Layout Randomization is disabled or can be bypassed, the same flaw can also lead to arbitrary code execution.

The vulnerability impacts the NGINX JavaScript engine supplied by F5. No specific affected product versions are listed in the available data, so any installation using the js_fetch_proxy directive with client‑controlled variables is potentially at risk.

The CVSS score of 9.2 indicates a high severity. Attackers can reach the flaw from outside the system by sending crafted HTTP requests, making it a remote unauthenticated vulnerability. The EPSS score of approximately 0.18% indicates a very low exploitation probability. The flaw is not listed in CISA’s KEV catalog, but the lack of mitigations such as ASLR greatly increases the exploit likelihood. Given the potential for immediate denial of service and conditional code execution, the risk remains high.