EUVD-2026-70142
GHSA-3gxx-pmrm-ghvv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted SAML message with malformed PrefixList attribute
-
DeliverySAML SP passes PrefixList to xml.exclusiveC14n() before signature verification
-
Exploitnjs XML namespace parser performs out-of-bounds heap write
-
Executionadjacent heap objects corrupted or prefix list leaked
-
PersistNGINX worker crash or memory exhaustion
-
Impactrepeated requests sustain denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Two distinct exploitation paths exist. First, generic njs path: NGINX must be configured with application code that calls xml.exclusiveC14n() and passes a namespace prefix list value derived from attacker-controlled input - this requires a non-default, explicitly written configuration and is not present in stock NGINX deployments. Second, SAML reference implementation path (higher real-world risk): any deployment using the nginxinc/nginx-saml reference SAML SP unconditionally passes InclusiveNamespaces/@PrefixList from any incoming SAML message (Response, Assertion, LogoutRequest, or LogoutResponse) to xml.exclusiveC14n() before signature verification; a valid SAML signature is not required, and any unauthenticated network client that can reach the SSO endpoint can trigger the flaw. Exploitation is data-plane only; no control-plane or management-interface exposure exists. The js_engine directive setting determines njs vs. QuickJS behavior (crash vs. memory leak), but does not affect exploitability. Code execution requires heap layout conditions beyond the attacker's control and has not been demonstrated. |
| Impact | The vendor-supplied CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1) reflects the worst-case scenario including potential code execution; however, the F5 advisory explicitly states RCE has not been demonstrated and cannot be ruled out on all platforms. Confirmed impact is DoS via repeatable worker restarts (njs) or heap exhaustion (QuickJS). AC:H correctly reflects the prerequisite that externally controlled input must reach xml.exclusiveC14n() - a non-default, explicitly configured behavior. For the SAML scenario the attack surface is substantially wider: any NGINX deployment using the nginxinc/nginx-saml reference implementation exposes an unauthenticated, network-reachable path to the flaw with no signature credential required. No CISA KEV listing and no confirmed public exploit code are available, reducing short-term automated exploitation risk, but the SAML attack path is fully described in the advisory and the technical barrier to DoS is low. EPSS data is absent from available inputs. Defenders should treat SAML-enabled NGINX deployments using the reference implementation as higher priority than generic njs deployments. |
| Exploit ScenarioDerived | An attacker sends a crafted SAML Response to an NGINX-based SAML service provider running the nginxinc/nginx-saml reference implementation, embedding a malformed InclusiveNamespaces/@PrefixList value. Because the implementation calls xml.exclusiveC14n() before verifying the SAML signature, no cryptographic credential is needed. The resulting out-of-bounds heap write crashes the NGINX worker; the attacker repeats the request across automatic worker restarts, maintaining a sustained denial-of-service condition against the SSO endpoint from an unauthenticated network position. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Heap out-of-bounds write in NGINX JavaScript (njs) xml.exclusiveC14n() allows unauthenticated remote attackers to crash NGINX worker processes or cause unbounded memory growth, with theoretical code execution that has not been demonstrated. The vulnerability is directly reachable in the nginxinc/nginx-saml reference SAML SP implementation, which passes untrusted InclusiveNamespaces/@PrefixList values to xml.exclusiveC14n() before signature verification completes - meaning no valid SAML signature is required to trigger it. Both the njs (default) and QuickJS engines are affected, with differing crash-vs-leak behavior, but both result in denial of service. No public exploit is identified at time of analysis.
RemediationAI
Consult the F5 advisory at https://my.f5.com/manage/s/article/K000162602 for exact patched njs release versions, which are not independently confirmed from the available input data. As an immediate compensating control for SAML deployments, validate and sanitize InclusiveNamespaces/@PrefixList values before they reach xml.exclusiveC14n(), or restructure the implementation to defer PrefixList parsing until after SAML signature verification succeeds - the latter eliminates the unauthenticated attack path entirely. For internet-exposed SAML SSO endpoints that cannot be patched promptly, consider WAF rules that block SAML messages containing InclusiveNamespaces elements with PrefixList attributes, accepting the trade-off that valid SAML responses using C14N namespace inclusion may also be blocked. For general njs deployments, audit any js_content or js_filter blocks that pass externally sourced input to xml.exclusiveC14n() and restrict those paths to trusted data only. Switching from QuickJS to the njs engine converts heap leak to crash behavior but does not eliminate the OOB write.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NGINX JavaScript (njs) is F5's lightweight JavaScript engine embedded in NGINX for scripting HTTP and stream processing, identified by CPE cpe:2.3:a:f5:nginx_javascript:*:*:*:*:*:*:*:*. The root cause (CWE-122, heap-based buffer overflow) is in the XML module's namespace prefix list parser, invoked through xml.exclusiveC14n() - NGINX's implementation of Exclusive XML Canonicalization (C14N) as defined in the XML Digital Signature standard. C14N uses an InclusiveNamespaces/@PrefixList to determine which namespace declarations appear in canonical form during signature processing. A crafted prefix list causes an out-of-bounds write past the end of a heap allocation. Under the njs engine (active when the js_engine directive is absent), adjacent heap objects are corrupted, crashing the worker. Under the QuickJS engine, the prefix list is additionally leaked on every call, producing unbounded worker memory growth across requests. The architectural flaw in the nginxinc/nginx-saml reference implementation is that PrefixList is consumed before the SAML message's signature is verified, placing attacker-controlled data on the vulnerable code path before any trust boundary is enforced.
Know when Nginx Javascript gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
AC:H for non-default config or SAML reference implementation prerequisite; C:H/I:H retained for plausible worst-case heap OOB RCE, though undemonstrated; A:H for confirmed worker DoS.
Primary rating from Vendor (f5).
CVSS VectorVendor: f5
Lifecycle Timeline
4DescriptionCVE.org
Description
NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n() method. An unauthenticated remote attacker can trigger it when an affected NGINX configuration passes an externally controlled XML namespace prefix list to that method. Both the njs and the QuickJS (qjs) engines are affected. A crafted prefix list causes an out-of-bounds write past the end of a heap allocation. With the njs engine, which is the engine used when the js_engine directive is absent, this corrupts adjacent objects and crashes the NGINX worker. With the QuickJS engine, the same call additionally leaks the prefix list on every invocation, causing worker memory to grow across requests. The official nginxinc/nginx-saml reference implementation is affected during SAML signature verification. It reads InclusiveNamespaces/@PrefixList from an untrusted SAML message and passes it to xml.exclusiveC14n() before the signature has been verified, so a valid SAML signature is not required. A crafted SAML Response, Assertion, LogoutRequest, or LogoutResponse is sufficient. Code execution has not been demonstrated and cannot be ruled out for all platforms, as the effect of the out-of-bounds write depends on conditions beyond the attacker's control.
Impact
This vulnerability allows remote attackers to cause a denial of service on the NGINX system, either through repeatable worker restarts or through worker memory growth or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Articles & Coverage 2
Executive ViewAI
NGINX SAML service provider implementations are vulnerable to unauthenticated remote denial-of-service attacks due to a heap memory flaw in the njs XML processor. Attackers can crash NGINX worker processes or exhaust memory without valid credentials, directly disrupting authentication services for any organization using nginx-saml or custom NGINX-based SAML implementations. This affects the availability of authentication infrastructure with no vendor patch currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: disable njs XML processing if not required for business operations; implement strict input validation on SAML request elements, particularly InclusiveNamespaces/@PrefixList parameters; deploy request rate limiting on SAML endpoints; configure automated worker restart on out-of-memory conditions; add monitoring for worker process crashes and memory anomalies; consider WAF rules to filter malformed SAML XML at network perimeter; evaluate alternative SAML implementations without njs dependency.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Nginx Javascript
View allHeap buffer overflow in F5 NGINX JavaScript (njs) module versions 0.9.4 through 0.9.8 allows unauthenticated remote atta
NGINX JavaScript (njs) and QuickJS (qjs) fail open during the js_access phase when an exception is thrown inside an asyn
NULL pointer dereference in NGINX JavaScript (njs) crashes NGINX worker processes when an njs script calls ngx.fetch() a
Canonicalization inconsistency in the NGINX JavaScript (njs) XML module lets an unauthenticated attacker who already hol
Malformed XML parsed through NGINX JavaScript (njs) xml.parse() leaks libxml2 parser contexts, allowing unauthenticated
Exploit-DB