CVE-2026-101019 F5 CVE debrief

Who should care

NGINX JavaScript users, particularly those using nginx-saml deployments with the built-in njs backend, should assess exposure and verify their version. Affected operator, platform, vulnerability-management, and security-team impact should be reviewed to ensure proper mitigation.

Why it matters

NGINX JavaScript users should assess exposure and verify their version due to potential for signature verification bypass.

• An unauthenticated attacker may cause security-relevant attributes to appear absent or truncated while signature verification succeeds
• This can bypass expiry, Destination, and request-correlation checks, enabling replay or acceptance of a response outside its intended context
• No control plane exposure exists; this is a data impact

Technical summary

The NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. This may allow an unauthenticated attacker to skip validation while signature verification succeeds. The vulnerability affects nginx-saml deployments with the built-in njs backend. The $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference. The $attrs getter may return a value derived only from the first attribute child.

Defensive priority

Medium

Recommended defensive actions

• Review NGINX JavaScript configurations for potential exposure
• Verify version 1.0.2 or later is in use
• Monitor for unusual signed document validation behavior
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the NGINX JavaScript (njs) vulnerability. The NVD entry is currently UNCHANGED. The vulnerability affects nginx-saml deployments with the built-in njs backend. The $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference. The $attrs getter may return a value derived only from the first attribute child. This may allow an unauthenticated attacker that invests significant effort in obtaining a genuinely signed document to skip and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.