CVE-2026-78689

Description NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n() method. An unauthenticated remote attacker can trigger it when an affected NGINX configuration passes an externally controlled XML namespace prefix list to that method. Both the njs and the QuickJS (qjs) engines are affected. A crafted prefix list causes an out-of-bounds write past the end of a heap allocation. With the njs engine, which is the engine used when the js_engine directive is absent, this corrupts adjacent objects and crashes the NGINX worker. With the QuickJS engine, the same call additionally leaks the prefix list on every invocation, causing worker memory to grow across requests. The official nginxinc/nginx-saml reference implementation is affected during SAML signature verification. It reads InclusiveNamespaces/@PrefixList from an untrusted SAML message and passes it to xml.exclusiveC14n() before the signature has been verified, so a valid SAML signature is not required. A crafted SAML Response, Assertion, LogoutRequest, or LogoutResponse is sufficient. Code execution has not been demonstrated and cannot be ruled out for all platforms, as the effect of the out-of-bounds write depends on conditions beyond the attacker's control.   Impact This vulnerability allows remote attackers to cause a denial of service on the NGINX system, either through repeatable worker restarts or through worker memory growth or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

• CWE-122

• https://my.f5.com/manage/s/article/K000162602

Published

Sep 2, 2026

Last Modified

Sep 3, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-78680NLTK versions before 3.10.3 fail to use validated absolute p…7.8
• CVE-2026-78681NLTK versions before 3.10.3 use xml.etree.ElementTree to par…7.5
• CVE-2026-78682NLTK before 3.10.3 contains a server-side request forgery vu…7.5
• CVE-2026-78683NLTK before 3.10.0 (affected versions <=3.9.4) contains an u…9.6
• CVE-2026-78684vLLM before 0.27.0 fails to properly classify DeepStream as …5.3
• CVE-2026-78685Medical Practice Management System developed by Le-yan has a…8.8
• CVE-2026-7869IBM Langflow OSS 1.0.0 through 1.10.3 is vulnerable to Path …5.4
• CVE-2026-78691Improper Neutralization of Special Elements in Data Query Lo…2.1
• CVE-2026-78693Generation of Error Message Containing Sensitive Information…6.9
• CVE-2026-78699Unchecked Return Value vulnerability in ash-project ash_post…7.2
• CVE-2026-7870IBM i 7.6, 7.5, 7.4, and 7.3 could allow a user to gain elev…8.8
• CVE-2026-78701A flaw was found in 389-ds-base. A remote, authenticated att…6.5