NGINX JavaScript (njs) CVE-2026-101019

Exploitation requires the target to be a signed-XML consumer that uses the njs XML module (either the built-in njs backend or the QuickJS backend) during canonicalization - nginx-saml running the built-in njs backend is the confirmed affected deployment. The attacker must first obtain a genuinely signed XML/SAML document, which the description explicitly calls out as requiring significant effort (reflected as AT:P in the CVSS 4.0 vector). Key limiting factors: the flaw cannot forge signatures or identities and cannot produce a new validly signed document, so the attacker is confined to manipulating attribute visibility on an already-signed artifact; impact is data-plane only with no control-plane exposure and no availability impact; and non-njs or non-signed-XML nginx deployments are unaffected. End-of-Technical-Support versions were not evaluated.

The vendor-assigned CVSS 4.0 base score is 8.3 (High), driven by AV:N/AC:L/PR:N/UI:N and VC:H. However, the AT:P (Attack Requirements: Present) metric is the decisive moderating signal: successful exploitation requires the attacker to invest significant effort in obtaining a genuinely signed XML document, since the flaw does NOT permit signature or identity forgery. This makes real-world exploitation materially harder than the headline score suggests. There is no EPSS score, no CISA KEV listing, and no public exploit code in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - this is not a drop-everything priority. The impact is bounded: data-plane only, no control-plane exposure, no availability impact (VA:N), and only partial integrity impact (VI:L). The realistic priority is MODERATE-but-credible for the narrow population of signed-XML consumers using njs - specifically nginx-saml with the built-in njs backend, which F5 confirms is affected. One note: the input provides only a CVSS 4.0 vector with no EPSS, KEV, or POC signals, so the dynamic exploitation picture cannot be cross-referenced; the AT:P/signed-document requirement strongly implies targeted rather than widespread/opportunistic exploitation if it ever occurs.

An unauthenticated attacker who has obtained a genuinely signed SAML response (a non-trivial, effortful prerequisite) submits it to an nginx-saml deployment running the built-in njs backend. Due to inconsistent canonicalization of entity-backed XML attributes, security-relevant attributes appear absent or truncated while libxml2 signature verification still succeeds, letting the attacker bypass expiry, Destination, and request-correlation checks to replay or reuse the response outside its intended context. No public exploit code is identified in the provided data.