{"schema":"threatline.record/2","record":{"id":"CVE-2026-101019","aliases":[],"summary":"NGINX ngx_http_js_module vulnerability","details":"Description\nNGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference. The $attrs getter may return a value derived only from the first attribute child. This may allow an unauthenticated attacker that invests significant effort in obtaining a genuinely signed document to skip validation while signature verification succeeds. An nginx-saml deployment is a confirmed affected consumer when run with the built-in njs backend.\n\nImpact\nIn affected signed-XML consumers, an unauthenticated attacker can cause security-relevant attributes to appear absent or truncated while signature verification succeeds. In nginx-saml, this can bypass expiry, Destination, and request-correlation checks, enabling replay or acceptance of a response outside its intended context. It does not permit signature or identity forgery, or a direct availability impact. There is no control plane exposure; this is a data plane issue only.\n\n\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","categories":["Web servers"],"product":"NGINX JavaScript","vendor":"F5","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101019","source_modified_at":"2026-10-15T16:43:46.354Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"NGINX JavaScript","vendor":"F5","versions":[{"lessThan":"1.0.2","status":"affected","version":"0.7.10","versionType":"custom"}],"defaultStatus":"unknown"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101019","source_modified_at":"2026-10-15T16:43:46.354Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"NGINX JavaScript","ecosystem":null},"version":"1.0.2","basis":"first unaffected version stated in the CVE record"}],"cvss":6.5,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.002,"percentile":0.09283,"score_date":"2026-10-23"},"published_at":"2026-10-14T14:40:29.685Z","modified_at":"2026-10-15T16:43:46.354Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-101019","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-15T16:43:46.354Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101019","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://my.f5.com/manage/s/article/K000162615","tags":["vendor-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-15T15:54:18.777169Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-15T16:43:46.354Z","content_hash":"31a898c08d08fd95c088ba66b72b9bda57caa88e31b03f5d5403d803f05da940"}}