CVE-2026-101019: njs XML bug lets signed SAML responses skip validation checks

What it is

A bug in the njs XML module, the XML parser used by NGINX JavaScript (ngx_http_js_module). It returns attribute values that don’t match what libxml2 uses when it canonicalizes a document for signature checks. This happens when an attribute contains an internal entity reference, which a DTD defines. In both the built-in njs and QuickJS backends:

• the attribute name getter can return undefined;
• the attributes getter can return a value built from only the first attribute child.

So a security-relevant attribute can look missing or truncated to your JavaScript code, while the signature check on the same document still succeeds. The record’s weakness is CWE-436 (interpretation conflict).

The attacker needs a genuinely signed document, for example a real SAML response. The CVE record says the bug does not allow signature or identity forgery, and does not affect availability. It is a data-plane issue only.

The confirmed affected consumer is nginx-saml, F5’s reference implementation of NGINX Plus as a SAML service provider, when it runs on the built-in njs backend. There the bug can bypass expiry, Destination and request-correlation checks. In practice that could let a captured, still-validly-signed assertion be replayed after it should have expired, or sent to the wrong service.

No exploitation, public proof of concept or CISA KEV listing has been reported in the sources we checked.

Am I affected?

You are exposed if both are true:

1. You load the njs module (ngx_http_js_module) at version 0.7.10 up to, but not including, 1.0.2.
2. Your njs code parses XML with xml.parse() and relies on attribute values or names for security decisions. The confirmed case is nginx-saml on the built-in njs backend.

If you use njs only for non-XML work, this CVE does not change your risk.

To check, look for these in your NGINX configuration and njs files:

• js_import or js_include directives, and load_module lines for ngx_http_js_module.so;
• calls to xml.parse() or other use of the xml module in your scripts;
• an nginx-saml deployment.

For the njs version, use your package manager’s version for the njs module package (for NGINX Plus, nginx-plus-module-njs). We could not read the F5 advisory, so we give no vendor command here.

F5 says software past End of Technical Support was not evaluated.

What to do

1. Upgrade njs to 1.0.2 or later. On NGINX Plus, install the module build F5 lists in advisory K000162615. See the CVE record’s vendor advisory link for the fixed NGINX Plus builds.
2. If you can’t upgrade yet, reject DTD-bearing input before calling xml.parse(). Check the full document after decoding. F5 prefers a parser-level DTD prohibition over a raw byte search.
3. Treat absent security-relevant attributes as validation failures. Don’t continue when an attribute you expect is undefined.
4. For nginx-saml, validate explicitly: Destination, InResponseTo correlation (when you don’t intend unsolicited SSO), assertion validity times, bearer SubjectConfirmation, Recipient, and SubjectConfirmationData InResponseTo.
5. Production impact: rejecting DTDs is safe for SAML, which doesn’t need them. Stricter checks may reject unusual identity-provider responses, so test with your IdP first.
6. If you were exposed, there is nothing to rebuild or rotate. The bug does not expose keys or allow forged identities. Review SAML logins for the period you ran an affected version (below).

Detection

No indicators of compromise have been published, and no exploitation has been reported.

• SAML responses containing a DTD (<!DOCTYPE or <!ENTITY) sent to your nginx-saml endpoint. Legitimate identity providers don’t send these.
• Logins accepted for assertions past their validity time, or with a Destination that is not your service. Compare IdP login logs with NGINX access logs.
• Login responses with no matching request, where you don’t use unsolicited SSO.
• Repeated use of the same assertion across sessions.