Interpretation Conflict in NGINX JavaScript - CVE-2026-101019
Published: October 14, 2026
Vulnerability details
The vulnerability allows a remote attacker to bypass security-relevant validation in signed-XML consumers while signature verification succeeds.
The vulnerability exists due to an interpretation conflict between XML attribute exposure and libxml2 canonicalization in the njs XML module when processing signed XML attributes containing internal entity references. A remote attacker can supply a signed XML document with entity-backed attributes that appear absent or truncated to bypass security-relevant validation in signed-XML consumers while signature verification succeeds.
Exploitation requires significant effort to obtain a genuinely signed document. In nginx-saml deployments using the built-in njs backend, affected checks include expiry, destination, and request correlation. Exploitation does not permit signature or identity forgery and does not affect availability.