CVE-2026-78689: NGINX njs XML Module Out-of-Bounds Write Advisory, CVSS up to 9.2
F5 disclosed CVE-2026-78689, an out-of-bounds write in the NGINX JavaScript (njs) XML module. Unauthenticated remote attackers can crash workers or grow memory. The official nginx-saml reference implementation is affected.
CVE-2026-78689 is a high-severity vulnerability in the NGINX JavaScript (njs) module, recently disclosed by F5. The XML module's namespace prefix-list parser has an out-of-bounds write. Unauthenticated remote attackers can crash NGINX workers or cause sustained memory growth. The official nginx-saml reference implementation is affected on the SAML signature-verification path.
Incident Overview
F5 published advisory K000162602. The flaw is in the njs XML module and is reachable via xml.exclusiveC14n(). When NGINX config passes an externally controllable XML namespace prefix list into that method, an attacker can exploit it with no authentication. Both njs and QuickJS (qjs) engines are affected. Affected versions: 0.7.10 through versions before 1.0.1.
Technical Details
A crafted prefix list causes a heap buffer overflow past the end of the allocation (CWE-122). On the njs engine (the default when js_engine is not set), the OOB write corrupts adjacent heap objects and crashes the NGINX worker. On QuickJS, the same call also leaks prefix-list memory on every execution, so worker memory grows with each request.
The official nginxinc/nginx-saml reference implementation is affected during SAML signature verification: it passes InclusiveNamespaces/@PrefixList from an untrusted SAML message into xml.exclusiveC14n() before signature verification completes. An attacker does not need a valid SAML signature — a crafted SAML Response, Assertion, LogoutRequest, or LogoutResponse is enough.
Impact Assessment
CVSS v3.1 8.1 (High), CVSS v4.0 9.2 (Critical). Vectors: network, no privileges, no user interaction. Practical impact is primarily DoS: attackers can take down NGINX via reproducible worker restarts or memory growth. Code execution has not been demonstrated. Because OOB-write outcomes partly depend on heap state outside attacker control, F5 explicitly does not rule out code execution on all platforms. This is a data-plane issue; no control-plane exposure.
Remediation
- Upgrade njs to 1.0.1 or later (affected since 0.7.10).
- Audit all configs that call
xml.exclusiveC14n(). Do not pass XML namespace prefix lists from untrusted sources into that method. In SAML flows, process PrefixList only after signature verification succeeds. - Temporary mitigation: limit public exposure of management plane and SAML endpoints. Alert on abnormal worker restarts and monitor memory growth.
- Detection: watch worker abnormal exits and restart frequency, memory climb on qjs engine instances, and SAML LogoutRequest/Response traffic from unexpected sources.
References
- F5 security advisory K000162602
- CVE-2026-78689 details page