{"action":"Upgrade libnginx-mod-js to 0.9.9-1 or later.","affected":[{"fixed":"0.9.9-1","introduced":"0"}],"component":"libnginx-mod-js","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["0.9.9-1"],"id":"tcs_01M5NW1RVJDP73ZEEX9K8HXZAB","modified_at":"2026-10-01T03:03:51.311814227Z","published_at":"2026-05-19T15:16:33.017Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-8711","https://security-tracker.debian.org/tracker/CVE-2026-8711"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-8711","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-8711"}],"summary":"NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invokin"}