CVE-2026-101019

NGINX JavaScript (njs) mishandles XML attributes that contain internal entity references during canonicalization, so results disagree with libxml2. In both the built-in njs and QuickJS backends, the $attr$Name getter can return undefined for an attribute that is actually present, and the $attrs getter can return a value taken only from the first attribute child. An unauthenticated attacker who already has a genuinely signed document can make security-relevant attributes look missing or truncated while signature verification still succeeds. In nginx-saml with the built-in njs backend, that can bypass expiry, Destination, and request-correlation checks and allow replay or acceptance of a response outside its intended context; it does not forge signatures or identities and is a data-plane issue only. It is not listed in CISA KEV and no public proof-of-concept is known.

What to do: Apply F5/NGINX updates for njs and nginx-saml as soon as a fixed build is published; the advisory does not list version numbers. Until then, treat nginx-saml on the built-in njs backend as exposed and do not rely on njs $attr$Name or $attrs results for expiry, Destination, or request-correlation checks on signed XML. Prefer a validation path that is not the affected njs XML canonicalization behavior, and review logs for replayed or out-of-context SAML responses.