CVE-2026-101019

Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference. The $attrs getter may return a value derived only from the first attribute child. This may allow an unauthenticated attacker that invests significant effort in obtaining a genuinely signed document to skip validation while signature verification succeeds. An nginx-saml deployment is a confirmed affected consumer when run with the built-in njs backend. Impact In affected signed-XML consumers, an unauthenticated attacker can cause security-relevant attributes to appear absent or truncated while signature verification succeeds. In nginx-saml, this can bypass expiry, Destination, and request-correlation checks, enabling replay or acceptance of a response outside its intended context. It does not permit signature or identity forgery, or a direct availability impact. There is no control plane exposure; this is a data plane issue only.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

• CWE-436

• https://my.f5.com/manage/s/article/K000162615

Published

Oct 14, 2026

Last Modified

Oct 15, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-101013A security vulnerability has been detected in mathurvishal C…7.3
• CVE-2026-101014A vulnerability was detected in Trusted Domain Project OpenD…7.3
• CVE-2026-101015A flaw has been found in Trusted Domain Project OpenDMARC up…7.3
• CVE-2026-101016A vulnerability has been found in Trusted Domain Project Ope…6.5
• CVE-2026-101017A vulnerability was found in Trusted Domain Project OpenDMAR…6.5
• CVE-2026-101018A vulnerability was determined in dayrui XunruiCMS up to 4.7…4.7
• CVE-2026-101020An incorrect permission assignment for critical resource iss…8.5
• CVE-2026-101022A Modbus connection feature on openPDC accepts a caller-spec…4.3
• CVE-2026-101023Gitea's OAuth2 token endpoint verified the signature and gra…9.1
• CVE-2026-101024Satel Netco Design versions prior to v2.1.7 contains a relat…8.8
• CVE-2026-101025Description NGINX JavaScript (njs) has a vulnerability whe…5.3
• CVE-2026-101027When `[migrations] ALLOWED_DOMAINS` was configured, a hostna…7.7