{"action":"Upgrade njs to 0.9.9-r0 or later.","affected":[{"fixed":"0.9.9-r0","introduced":"0.9.4"}],"component":"njs","cve_ids":[],"ecosystem":"Alpine","ecosystem_qualifier":"Alpine:v3.24","exploited":false,"fixed_versions":["0.9.9-r0"],"id":"tcs_01M6HADYSC0VJ67BPT37D3DV2C","modified_at":"2026-11-03T06:33:04.192974850Z","published_at":"2026-05-19T15:16:33.017Z","references":["https://osv.dev/vulnerability/ALPINE-CVE-2026-8711","https://security.alpinelinux.org/vuln/CVE-2026-8711"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"ALPINE-CVE-2026-8711#Alpine:v3.24/njs","url":"https://osv.dev/vulnerability/ALPINE-CVE-2026-8711"}],"summary":"NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invokin"}