A vulnerability in the NGINX JavaScript (njs) module allows for improper proxy configuration, posing a significant risk of unauthorized request routing or data exposure.

The vulnerability exists within the js_fetch_proxy directive when configured with client-controlled NGINX variables (e.g., $http_*, $arg_*, $cookie_*). This flaw allows unauthenticated remote attackers to influence proxy behavior, potentially facilitating unauthorized access or SSRF-like conditions.

Successful exploitation of this vulnerability could lead to the compromise of internal network resources or the exfiltration of sensitive data routed through the proxy. With a CVSS score of 8.1, this represents a High severity risk that could result in significant reputational damage and service disruption if the proxy infrastructure is successfully manipulated.

Immediate Action: Review your nginx.conf files to identify instances where js_fetch_proxy utilizes client-controlled variables and restrict these configurations until a vendor patch is applied.

Proactive Monitoring: Monitor NGINX access and error logs for unusual request patterns, particularly those involving unexpected header modifications or proxy destination anomalies.

Compensating Controls: Implement strict input validation or use a Web Application Firewall (WAF) to sanitize incoming request parameters before they are processed by the NGINX JavaScript module.

Public Exploit Available: false

Given the High severity score, administrators should prioritize auditing their NGINX configurations immediately to identify potentially vulnerable js_fetch_proxy implementations. Apply vendor-provided security patches as soon as they become available to eliminate the underlying risk.