CVE-2026-101019: CWE-436 Interpretation Conflict in F5 NGINX JavaScript

CVE-2026-101019 describes a vulnerability in NGINX JavaScript (njs) where the XML module's handling of entity-backed XML attributes conflicts with libxml2 canonicalization. Specifically, during canonicalization, the $attr$Name getter may return undefined for attributes containing internal entity references, and the $attrs getter may only reflect the first attribute child. This discrepancy can allow an unauthenticated attacker, who has obtained a legitimately signed document, to bypass validation checks while signature verification passes. The nginx-saml deployment using the built-in njs backend is a confirmed affected consumer. The vulnerability impacts security-relevant attributes such as expiry, Destination, and request-correlation checks, enabling replay or acceptance of responses outside their intended context.

An unauthenticated attacker can exploit this vulnerability to cause security-relevant XML attributes to appear absent or truncated during validation, while the signature verification still succeeds. In nginx-saml deployments using the built-in njs backend, this can bypass critical checks like expiry and request correlation, enabling replay attacks or acceptance of responses outside their intended context. There is no impact on signature or identity forgery, nor is there any direct availability impact. The issue affects only the data plane with no control plane exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should be aware of the risk in signed-XML consumers using the built-in njs backend, such as nginx-saml, and consider mitigating controls at the application level if possible.