NGINX njs: Inconsistent XML attribute handling allows signed-XML validation bypass
Summary
The njs XML module of NGINX JavaScript returns inconsistent values for entity-backed XML attributes during canonicalization, in both the built-in njs and QuickJS backends. An unauthenticated attacker who can obtain a genuinely signed document can make security-relevant attributes appear absent or truncated while signature verification still succeeds. In nginx-saml with the built-in njs backend, this can bypass expiry, Destination and request-correlation checks, enabling replay of a response outside its intended context.
Affected
- NGINX JavaScript (njs) 0.7.10 to before 1.0.2, built-in njs and QuickJS backends
- nginx-saml deployments using the built-in njs backend
- Default configuration: unknown
Fixed in
- njs 1.0.2 (per F5 advisory K000162615)
- Note: njs 1.0.2 changes XML API behaviour (node mutation and canonicalization reject detached nodes). Test custom njs code before upgrading.
Workaround
- Reject DTD-bearing input before calling xml.parse(). Check the complete document after decoding its accepted input encoding; a parser-level DTD prohibition is preferable to a raw byte search for "<!DOCTYPE".
- Treat absent security-relevant attributes as validation failures.
- nginx-saml: explicitly validate Destination, InResponseTo, assertion validity, bearer SubjectConfirmation and Recipient.
- Switching to the QuickJS engine is not a mitigation, as both engines are affected.
Exploitation
- No known exploitation in the wild and no public proof of concept at the time of research.
- CISA SSVC: exploitation none, not automatable, partial technical impact.
- EPSS 0.002.
Our recommendation
- Check whether any NGINX host loads njs (js_import) and uses the XML module for signature validation, including nginx-saml.
- If affected, update njs to 1.0.2 or the fixed package of your distribution, and test custom njs code first.
- Until patched, reject DTD-bearing XML before parsing.
- Review SAML replay protection and Destination/audience checks as a compensating control.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- F5 Security Advisory K000162615 my.f5.com
- njs 1.0.2 release notes github.com
- F5 advisory nginx-saml K000162602 my.f5.com
- Ubuntu security tracker CVE-2026-101019 ubuntu.com
- NGINX security news nginx.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:46.
Original description (NVD)
Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference. The $attrs getter may return a value derived only from the first attribute child. This may allow an unauthenticated attacker that invests significant effort in obtaining a genuinely signed document to skip validation while signature verification succeeds. An nginx-saml deployment is a confirmed affected consumer when run with the built-in njs backend. Impact In affected signed-XML consumers, an unauthenticated attacker can cause security-relevant attributes to appear absent or truncated while signature verification succeeds. In nginx-saml, this can bypass expiry, Destination, and request-correlation checks, enabling replay or acceptance of a response outside its intended context. It does not permit signature or identity forgery, or a direct availability impact. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.