CVE-2026-101019
MediumCVSS 6.5Summary
The njs XML module in NGINX JavaScript (njs) exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends, the $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference, and the $attrs getter may return a value derived only from the first attribute child. This may allow an unauthenticated attacker to skip validation while signature verification succeeds.
Risk Assessment
In affected signed-XML consumers, security-relevant attributes can appear absent or truncated while signature verification succeeds. In nginx-saml, this can bypass expiry, Destination, and request-correlation checks, enabling replay or acceptance of a response outside its intended context.
Recommendation
Update NGINX JavaScript (njs) to a patched version and verify the backend used by your nginx-saml deployment. Until patched, consider adding application-side validation checks for SAML responses.
Other vulnerabilities in NGINX JavaScript (njs)
See all- CVE-2026-101025Medium
NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests with malformed XML and can cause unbounded memory growth in long-lived NGINX worker processes.
- CVE-2026-78689High
A vulnerability in the XML module of NGINX JavaScript (njs) affects the namespace prefix list parser, reachable through the xml.exclusiveC14n() method. An unauthenticated remote attacker can trigger an out-of-bounds write past the end of a heap allocation when an affected NGINX configuration passes an externally controlled XML namespace prefix list to that method. Both the njs and QuickJS (qjs) engines are affected.
Original NVD description (English source)
Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference. The $attrs getter may return a value derived only from the first attribute child. This may allow an unauthenticated attacker that invests significant effort in obtaining a genuinely signed document to skip validation while signature verification succeeds. An nginx-saml deployment is a confirmed affected consumer when run with the built-in njs backend. Impact In affected signed-XML consumers, an unauthenticated attacker can cause security-relevant attributes to appear absent or truncated while signature verification succeeds. In nginx-saml, this can bypass expiry, Destination, and request-correlation checks, enabling replay or acceptance of a response outside its intended context. It does not permit signature or identity forgery, or a direct availability impact. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS