CVE-2026-78689

Name of the Vulnerable Software and Affected Versions NGINX JavaScript (njs) (affected versions not specified)

Description A flaw exists in the XML module's namespace prefix list parser, accessible via the xml.exclusiveC14n() method. An unauthenticated remote attacker can trigger this issue by providing a crafted XML namespace prefix list through an affected NGINX configuration. This leads to an out-of-bounds write past the end of a heap allocation. When using the njs engine (the default when the js engine directive is absent), this results in the corruption of adjacent objects and crashes the NGINX worker. When using the QuickJS (qjs) engine, the call also leaks the prefix list on every invocation, causing worker memory to increase across requests. The official nginxinc/nginx-saml reference implementation is specifically affected during SAML signature verification because it processes the InclusiveNamespaces/@PrefixList variable from untrusted SAML messages (such as Response, Assertion, LogoutRequest, or LogoutResponse) before verifying the signature. This can lead to a denial of service through worker restarts or memory growth, and potentially allow for code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.