Nginx JavaScript Vulnerability in XML Module Exposes Security Risks

CVE-2026-101019

What is CVE-2026-101019?

The NGINX JavaScript (njs) XML module suffers from a vulnerability that inconsistently exposes entity-backed XML attributes in comparison to libxml2 canonicalization. During the processing of XML data, the $attr$Name getter may yield undefined for attributes that contain internal entity references, while the $attrs getter may provide incomplete values from only the first attribute child. This issue presents a potential risk for unauthenticated attackers who could exploit it in signed-XML consumers, leading to omissions or truncations of security-relevant attributes without raising alarms during signature verification. Specifically, in nginx-saml implementations utilizing the built-in njs backend, the vulnerability may permit the circumvention of essential checks for expiry, Destination, and request-correlation, thereby facilitating unauthorized replay or acceptance of responses out of their intended context.

References