CVE-2026-101019: NGINX ngx_http_js_module vulnerability
Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference. The $attrs getter may return a value derived only from the first attribute child. This may allow an unauthenticated attacker that invests significant effort in obtaining a genuinely signed document to skip validation while signature verification succeeds. An nginx-saml deployment is a confirmed affected consumer when run with the built-in njs backend.
Impact In affected signed-XML consumers, an unauthenticated attacker can cause security-relevant attributes to appear absent or truncated while signature verification succeeds. In nginx-saml, this can bypass expiry, Destination, and request-correlation checks, enabling replay or acceptance of a response outside its intended context. It does not permit signature or identity forgery, or a direct availability impact. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Software
Event History
Frequently Asked Questions
Which deployments are confirmed to be affected?
nginx-saml is a confirmed affected consumer when it runs with the built-in njs backend. The issue applies to affected signed-XML consumers using the njs XML module; both built-in njs and QuickJS backends exhibit the inconsistent canonicalization behavior.
What must an attacker have to exploit this issue?
The attacker does not need authentication, but must invest significant effort to obtain a genuinely signed document. The issue does not enable creation of a forged signature or identity.
What is the practical impact for nginx-saml?
An attacker may bypass expiry, Destination, and request-correlation checks, allowing replay or acceptance of a response outside its intended context. The issue is limited to the data plane and does not create control-plane exposure or a direct availability impact.