The vulnerability in NGINX JavaScript (version 0.9.4) involves a heap-based buffer overflow triggered by the js_fetch_proxy directive when it uses client-controlled variables such as $http_*, $arg_*, or $cookie_*. When a location invokes ngx.fetch(), an attacker can send specially crafted HTTP requests to exploit this flaw. This leads to a heap buffer overflow in the NGINX worker process, causing a crash and restart. Furthermore, if Address Space Layout Randomization (ASLR) is disabled or bypassed, the attacker may achieve remote code execution. The vulnerability is tracked as CWE-122 and has a CVSS 3.1 base score of 8.1, indicating high severity. The vendor has not provided a patch or official remediation at this time.

Successful exploitation can cause the NGINX worker process to crash and restart due to a heap buffer overflow. On systems without ASLR or where ASLR can be bypassed, attackers may execute arbitrary code remotely. This impacts confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid configuring js_fetch_proxy with client-controlled variables or disable the affected functionality if possible. Monitor vendor communications for updates on patches or mitigations.