CVE-2026-78689: NGINX JavaScript XML Module DOS Vulnerability

CVE-2026-78689 Overview

CVE-2026-78689 is a heap-based out-of-bounds write in the NGINX JavaScript (njs) XML module. The flaw resides in the namespace prefix list parser reachable through the xml.exclusiveC14n() method. An unauthenticated remote attacker can trigger the vulnerability when an affected NGINX configuration passes an externally controlled XML namespace prefix list to that method. Both the njs and QuickJS (qjs) engines are affected. The official nginxinc/nginx-saml reference implementation is vulnerable during SAML signature verification because it reads InclusiveNamespaces/@PrefixList from untrusted SAML messages before signature validation.

Critical Impact
Remote unauthenticated attackers can crash NGINX workers, cause worker memory growth, and potentially trigger code execution through a crafted SAML Response, Assertion, LogoutRequest, or LogoutResponse.

Affected Products

NGINX JavaScript (njs) module — XML component using xml.exclusiveC14n()
NGINX with the QuickJS (qjs) engine enabled via the js_engine directive
nginxinc/nginx-saml reference implementation performing SAML signature verification

Discovery Timeline

2026-09-02 - CVE-2026-78689 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-78689

Vulnerability Analysis

The vulnerability is a heap out-of-bounds write [CWE-122] in the namespace prefix list parser inside the njs XML module. When xml.exclusiveC14n() receives an attacker-controlled prefix list, the parser writes past the end of a heap allocation. Under the default njs engine, this corrupts adjacent heap objects and crashes the NGINX worker process. Under the QuickJS engine, each invocation also leaks the prefix list, so worker memory grows continuously across requests. Code execution has not been demonstrated but cannot be excluded, as the outcome of the out-of-bounds write depends on heap layout and platform-specific factors. The issue is a data plane vulnerability; the control plane is not exposed.

Root Cause

The parser handling the XML namespace prefix list does not correctly bound writes into its heap allocation. Crafted input containing unexpected prefix list structure causes the parser to exceed the allocated buffer. On the QuickJS engine, the parser additionally retains the prefix list beyond its intended lifetime, producing a persistent memory leak.

Attack Vector

An unauthenticated attacker sends a crafted XML document containing a malicious InclusiveNamespaces/@PrefixList value to an NGINX endpoint whose configuration invokes xml.exclusiveC14n() on that untrusted input. In the nginxinc/nginx-saml reference implementation, the vulnerable call occurs during canonicalization before signature verification. A valid SAML signature is therefore not required. A SAML Response, Assertion, LogoutRequest, or LogoutResponse containing the crafted prefix list is sufficient to reach the parser. The attack does not require authentication, user interaction, or elevated privileges. No verified proof-of-concept code has been published; refer to the F5 Support Article K000162602 for vendor technical details.

Detection Methods for CVE-2026-78689

Indicators of Compromise

Unexpected NGINX worker process crashes or repeated worker restart events in error.log correlated with SAML endpoint traffic.
Sustained memory growth in NGINX worker processes when the QuickJS js_engine is configured.
Inbound SAML messages containing unusually structured InclusiveNamespaces/@PrefixList values addressed to /saml/-style endpoints.

Detection Strategies

Inspect HTTP request bodies to SAML endpoints for malformed or oversized InclusiveNamespaces elements before they reach NGINX workers.
Alert on repeated NGINX worker termination signals within a short window on hosts fronting SAML-enabled applications.
Correlate NGINX worker resident set size (RSS) growth trends against request volume to identify the QuickJS memory leak pattern.

Monitoring Recommendations

Enable verbose NGINX error logging and forward logs to a centralized analytics platform for worker crash correlation.
Monitor process-level memory metrics for NGINX workers and alert on sustained upward trends independent of load.
Track SAML endpoint request rates and payload sizes to identify anomalous prefix list content.

How to Mitigate CVE-2026-78689

Immediate Actions Required

Apply the fixed njs release referenced in the F5 Support Article K000162602 as soon as it is available for your platform.
If using the nginxinc/nginx-saml reference implementation, disable or restrict the SAML endpoints exposed to untrusted networks until patched.
Audit NGINX configurations for any use of xml.exclusiveC14n() on externally controlled input.

Patch Information

Refer to F5's advisory K000162602 for the fixed njs and NGINX package versions. Software versions that have reached End of Technical Support are not evaluated in the advisory and should be upgraded to a supported release.

Workarounds

Remove or comment out configuration blocks that invoke xml.exclusiveC14n() on untrusted inputs where the SAML flow is not required.
Front NGINX with a Web Application Firewall (WAF) rule that rejects SAML messages containing malformed InclusiveNamespaces/@PrefixList values.
Restrict access to SAML endpoints to known identity provider IP ranges where feasible.

bash

# Example WAF-style rule concept: block requests to SAML endpoints
# whose body contains suspiciously long PrefixList values.
# Adapt syntax to your WAF (ModSecurity, NGINX App Protect, etc.).
SecRule REQUEST_URI "@beginsWith /saml/" \
  "phase:2,deny,status:400,id:1078689,\
   chain,msg:'CVE-2026-78689 suspicious PrefixList'"
  SecRule REQUEST_BODY "@rx PrefixList=\"[^\"]{512,}\"" "t:none"