Description

Description NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n() method. An unauthenticated remote attacker can trigger it when an affected NGINX configuration passes an externally controlled XML namespace prefix list to that method. Both the njs and the QuickJS (qjs) engines are affected. A crafted prefix list causes an out-of-bounds write past the end of a heap allocation. With the njs engine, which is the engine used when the js_engine directive is absent, this corrupts adjacent objects and crashes the NGINX worker. With the QuickJS engine, the same call additionally leaks the prefix list on every invocation, causing worker memory to grow across requests. The official nginxinc/nginx-saml reference implementation is affected during SAML signature verification. It reads InclusiveNamespaces/@PrefixList from an untrusted SAML message and passes it to xml.exclusiveC14n() before the signature has been verified, so a valid SAML signature is not required. A crafted SAML Response, Assertion, LogoutRequest, or LogoutResponse is sufficient. Code execution has not been demonstrated and cannot be ruled out for all platforms, as the effect of the out-of-bounds write depends on conditions beyond the attacker's control.   Impact This vulnerability allows remote attackers to cause a denial of service on the NGINX system, either through repeatable worker restarts or through worker memory growth or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-02T16:17:25.667Z",
  "pubdate": "2026-09-02T16:17:25.667Z",
  "executiveSummary": "This vulnerability involves an out-of-bounds (OOB) write flaw within the XML module of NGINX JavaScript (njs).\nThe issue resides in the namespace prefix list parser invoked via the xml.exclusiveC14n() method.\nAffected environments include both the njs engine and the QuickJS (qjs) engine.\nUnauthenticated remote attackers can trigger this memory corruption by providing a crafted XML namespace prefix list via an externally controlled input.\nThe impact ranges from denial-of-service (DoS) scenarios—manifested through worker process crashes or memory exhaustion (leakage)—to the potential, though unverified, risk of arbitrary code execution.\nThe vulnerability is particularly critical in configurations utilizing nginxinc/nginx-saml, where the insecure processing of untrusted SAML assertions allows for remote exploitation before signature verification occurs.\nThe flaw presents a significant data plane risk, requiring urgent attention to update affected modules and sanitize input processing logic.",
  "technicalDetails": "The vulnerability is localized to the namespace prefix list parser within the NGINX JavaScript (njs) XML module, specifically triggered when the xml.exclusiveC14n() method is executed.\nThe root cause is a memory management error during the parsing of the InclusiveNamespaces/@PrefixList attribute. When an attacker provides a maliciously crafted prefix list, the parser fails to properly validate memory boundaries, leading to an out-of-bounds write operation beyond the allocated heap buffer.\nIn the context of the njs engine, the out-of-bounds write facilitates the corruption of adjacent heap-resident objects. This internal memory corruption inevitably results in an immediate crash of the NGINX worker process, leading to a repeatable denial-of-service condition.\nWhen using the QuickJS (qjs) engine, the impact profile changes; the OOB write behavior facilitates persistent memory leakage. Each malicious invocation of the function causes the worker process to allocate and leak heap memory, leading to monotonic memory growth that eventually degrades system performance or results in process exhaustion.\nThe attack flow involves the following: 1) The attacker transmits a crafted XML-based payload, such as a SAML Response, Assertion, LogoutRequest, or LogoutResponse. 2) The NGINX server, using the nginxinc/nginx-saml reference implementation, extracts the InclusiveNamespaces/@PrefixList from the untrusted payload. 3) The application passes this unverified string directly to xml.exclusiveC14n(). 4) The njs XML parser processes the input, triggers the heap-based OOB write, and either crashes the worker or causes memory depletion.\nBecause the vulnerable function is called prior to SAML signature verification, the attacker does not require valid credentials or authentication to trigger the flaw, allowing for unauthenticated remote exploitation.\nWhile remote code execution (RCE) has not been explicitly demonstrated in a controlled exploit, it cannot be ruled out. The consequence of the OOB write is contingent upon heap layout and environmental variables, which may provide an attacker the primitives necessary to overwrite function pointers or other critical memory structures to redirect control flow."
}