{"id":"UBUNTU-CVE-2026-101019","details":"Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference. The $attrs getter may return a value derived only from the first attribute child. This may allow an unauthenticated attacker that invests significant effort in obtaining a genuinely signed document to skip validation while signature verification succeeds. An nginx-saml deployment is a confirmed affected consumer when run with the built-in njs backend. Impact In affected signed-XML consumers, an unauthenticated attacker can cause security-relevant attributes to appear absent or truncated while signature verification succeeds. In nginx-saml, this can bypass expiry, Destination, and request-correlation checks, enabling replay or acceptance of a response outside its intended context. It does not permit signature or identity forgery, or a direct availability impact. There is no control plane exposure; this is a data plane issue only.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","modified":"2026-10-17T12:57:53.613845741Z","published":"2026-10-15T00:00:00Z","upstream":["CVE-2026-101019"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-101019"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-101019"},{"type":"REPORT","url":"https://my.f5.com/manage/s/article/K000162615"}],"affected":[{"package":{"name":"libnginx-mod-js","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/libnginx-mod-js?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.12-2","0.8.2-1ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"libnginx-mod-http-js","binary_version":"0.8.2-1ubuntu1"},{"binary_name":"libnginx-mod-stream-js","binary_version":"0.8.2-1ubuntu1"},{"binary_version":"0.8.2-1ubuntu1","binary_name":"njs"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-101019.json"}},{"package":{"name":"libnginx-mod-js","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/libnginx-mod-js?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.4-1build2","0.9.9-2","1.0.0-1","1.0.0-3"],"ecosystem_specific":{"binaries":[{"binary_name":"libnginx-mod-http-js","binary_version":"1.0.0-3"},{"binary_version":"1.0.0-3","binary_name":"libnginx-mod-stream-js"},{"binary_name":"njs","binary_version":"1.0.0-3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-101019.json"}},{"package":{"name":"libnginx-mod-js","ecosystem":"Ubuntu:Pro:26.04:LTS","purl":"pkg:deb/ubuntu/libnginx-mod-js?arch=source&distro=esm-apps%2Fresolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.1-1ubuntu2","0.9.1-1ubuntu3","0.9.4-1~build1","0.9.4-1","0.9.4-1build1","0.9.4-1build2","0.9.4-1ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"libnginx-mod-http-js","binary_version":"0.9.4-1ubuntu0.1~esm1"},{"binary_name":"libnginx-mod-stream-js","binary_version":"0.9.4-1ubuntu0.1~esm1"},{"binary_version":"0.9.4-1ubuntu0.1~esm1","binary_name":"njs"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-101019.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]}