SB2026101474 - Multiple vulnerabilities in NGINX JavaScript

Description

This security bulletin contains information about 2 vulnerabilities.

1) Memory leak (CVE-ID: CVE-2026-101025)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to failure to release a libxml2 parser context in the built-in njs engine's xml.parse() function within ngx_http_js_module when parsing malformed XML fails. A remote attacker can send requests that repeatedly trigger parsing of malformed XML to cause a denial of service.

This issue is limited to the data plane; there is no control plane exposure.

2) Interpretation Conflict (CVE-ID: CVE-2026-101019)

CWE-ID: CWE-436 - Interpretation Conflict

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass security-relevant validation in signed-XML consumers while signature verification succeeds.

The vulnerability exists due to an interpretation conflict between XML attribute exposure and libxml2 canonicalization in the njs XML module when processing signed XML attributes containing internal entity references. A remote attacker can supply a signed XML document with entity-backed attributes that appear absent or truncated to bypass security-relevant validation in signed-XML consumers while signature verification succeeds.

Exploitation requires significant effort to obtain a genuinely signed document. In nginx-saml deployments using the built-in njs backend, affected checks include expiry, destination, and request correlation. Exploitation does not permit signature or identity forgery and does not affect availability.

Remediation

Install update from vendor's website.

References

• https://my.f5.com/manage/s/article/K000162614
• https://my.f5.com/manage/s/article/K000162615