CVE-2026-78689

NGINX JavaScript (njs), the scripting engine for NGINX, contains a heap out-of-bounds write (CWE-122) in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n() method when an NGINX configuration passes an externally controlled XML namespace prefix list to it; the flaw is rated 9.2 critical in CVSS v4.0. An unauthenticated remote attacker can trigger it by supplying a crafted prefix list, most notably by sending a crafted SAML Response, Assertion, LogoutRequest, or LogoutResponse to the official nginxinc/nginx-saml reference implementation, which reads InclusiveNamespaces/@PrefixList from untrusted SAML messages and passes it to xml.exclusiveC14n() before the signature is verified, so no valid SAML signature is required. Under the default njs engine (used when the js_engine directive is absent), the out-of-bounds write corrupts adjacent heap objects and crashes the NGINX worker, while under the QuickJS (qjs) engine it additionally leaks the prefix list on every invocation, driving worker memory growth; code execution has not been demonstrated but cannot be ruled out. Any NGINX deployment whose configuration calls xml.exclusiveC14n() with attacker-controlled data on either engine is affected, and the issue is data-plane only with no control-plane exposure. Exploitation has not been observed: no public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS estimates roughly a 0.5% probability of exploitation within 30 days.

What to do: Audit NGINX configurations for njs usage that calls xml.exclusiveC14n() with externally supplied data - most notably the nginxinc/nginx-saml reference implementation, which feeds untrusted SAML InclusiveNamespaces/@PrefixList in before signature verification - and upgrade njs (both njs and qjs engines) to the vendor-patched release per F5's security advisory, noting that End-of-Technical-Support versions are not evaluated. Until patched, mitigate by hard-coding or validating the prefix list rather than accepting it from untrusted messages, and monitor for repeated NGINX worker crashes (default njs engine) or steadily growing worker memory (QuickJS engine) as indicators of attempted exploitation.