New NGINX Vulnerability (CVE-2026-8711): Check Point-Managed NGINX Deployments Not Affected

[Vani]

Description

A recently disclosed vulnerability affecting NGINX JavaScript (njs) has generated industry attention due to the potential for buffer overflow conditions in vulnerable deployments.

The vulnerability impacts NGINX JavaScript (njs) versions 0.9.4 through 0.9.8, with remediation introduced in njs version 0.9.9. Public reporting indicates that vulnerable environments may be exposed to denial-of-service conditions and, under certain circumstances, possible remote code execution.

Check Point Statement Regarding NGINX Vulnerability CVE-2026-8711

Check Point-managed NGINX deployments are not affected by CVE-2026-8711.

The vulnerability affects NGINX JavaScript (njs) versions 0.9.4 through 0.9.8. Check Point-managed deployments use a version outside the affected range and do not contain the vulnerable code path associated with this issue.

At this time, no action is required for customers using Check Point-managed NGINX deployments.

Nevertheless, updated images including the latest supported NGINX components will be released shortly (the new release will be addressing both CVE-2026-8711 and CVE-2026-42945) as part of Check Point’s ongoing security and software maintenance process (see Check Point’s statement on CVE-2026-42945)

Organizations operating independently managed NGINX environments should review their deployed njs versions and apply vendor-recommended updates and mitigations where applicable.

Check Point continues to monitor relevant security advisories and assess their potential impact on managed services and customer deployments.

For any questions or additional guidance, please contact your Check Point representative. Check Point remains committed to keeping customers secure and staying ahead of emerging vulnerabilities.