CVE-2026-78689: 
NGINX vulnerability analysis and mitigation

CVE-2026-78689 is a heap-based buffer overflow (CWE-122) in NGINX JavaScript (njs) affecting the XML module's namespace prefix list parser, reachable via the xml.exclusiveC14n() method. An unauthenticated remote attacker can trigger an out-of-bounds write past the end of a heap allocation when an affected NGINX configuration passes an externally controlled XML namespace prefix list to that method. Affected versions span njs 0.7.10 through versions prior to 1.0.1; both the njs and QuickJS (qjs) engines are impacted. The vulnerability was published on September 2, 2026, with a CVSS v3.1 score of 8.1 (High) and a CVSS v4.0 score of 9.2 (Critical) (GitHub Advisory).

The root cause is a heap-based buffer overflow (CWE-122) in the XML module's namespace prefix list parser within njs. When a crafted InclusiveNamespaces/@PrefixList value is passed to xml.exclusiveC14n(), it triggers an out-of-bounds write past the end of a heap allocation. With the njs engine (the default when js_engine is absent), this corrupts adjacent heap objects and crashes the NGINX worker process; with the QuickJS engine, the same call additionally leaks the prefix list on every invocation, causing progressive worker memory growth. The official nginxinc/nginx-saml reference implementation is particularly exposed because it reads InclusiveNamespaces/@PrefixList from untrusted SAML messages (Response, Assertion, LogoutRequest, or LogoutResponse) and passes it to xml.exclusiveC14n() before signature verification is complete, meaning no valid SAML signature is required to trigger the flaw (GitHub Advisory).

Successful exploitation primarily causes denial of service through repeatable NGINX worker process crashes (njs engine) or progressive memory exhaustion across requests (QuickJS engine). While code execution has not been demonstrated, it cannot be ruled out on all platforms, as the effect of the out-of-bounds write depends on heap layout conditions beyond the attacker's direct control. The vulnerability is a data plane issue only — there is no control plane exposure — but the ability to repeatedly crash worker processes without authentication makes it a significant availability risk for any NGINX deployment using the affected XML/SAML functionality (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.41–0.45%, placing it in roughly the 38th percentile for exploitation probability within 30 days. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The vulnerability is not automatable per NVD SSVC assessment, as specific deployment conditions (NGINX configured to pass externally controlled XML namespace prefix lists, or use of the nginx-saml reference implementation) must be present.

1. Reconnaissance: Identify NGINX deployments that use njs with XML processing or the nginxinc/nginx-saml reference implementation, using tools like Shodan or Censys to find SAML SSO endpoints (e.g., /saml/acs, /saml/slo).
2. Craft malicious SAML message: Construct a SAML Response, Assertion, LogoutRequest, or LogoutResponse containing a malformed InclusiveNamespaces/@PrefixList attribute — a crafted namespace prefix list designed to overflow the heap buffer when parsed by xml.exclusiveC14n().
3. Submit without valid signature: Send the crafted SAML message to the target SAML endpoint. Because the nginx-saml implementation passes the prefix list to xml.exclusiveC14n() before signature verification, no valid SAML signature is required.
4. Trigger out-of-bounds write: The njs XML parser processes the malformed prefix list, writing past the end of the heap allocation. With the njs engine, this corrupts adjacent objects and crashes the NGINX worker process; with QuickJS, memory leaks accumulate across repeated requests.
5. Sustain denial of service: Repeat the request to continuously crash worker processes or exhaust worker memory, causing sustained service disruption (GitHub Advisory).

• Logs: Repeated NGINX worker crash entries in error logs (e.g., worker process XXXX exited on signal 11 or similar segfault signals); unusual frequency of worker restarts in nginx/error.log.
• Logs: Access log entries showing repeated POST requests to SAML endpoints (e.g., /saml/acs, /saml/slo) from the same or rotating source IPs with large or malformed XML bodies.
• Process: NGINX master process repeatedly spawning new worker processes in short intervals, observable via ps, systemd journal, or process monitoring tools.
• Network: High volume of SAML endpoint requests from a single source or distributed sources, particularly with oversized or structurally anomalous XML payloads.
• System: Steadily increasing memory consumption of NGINX worker processes over time (indicative of QuickJS engine memory leak exploitation), detectable via top, htop, or memory monitoring dashboards.

Update NGINX JavaScript (njs) to version 1.0.1 or later, which contains the patch for this vulnerability. If using the nginxinc/nginx-saml reference implementation, update it to the patched version referenced in the F5 advisory (K000162602 at my.f5.com). As an interim workaround where immediate patching is not possible, implement input validation or filtering for XML namespace prefix lists before they reach xml.exclusiveC14n(), and restrict network access to NGINX SAML endpoints to trusted sources only (GitHub Advisory).

The vulnerability was noted in the Microsoft September 2026 Patch Tuesday coverage by BleepingComputer, which reported on 96+ flaws addressed that cycle. Security community discussion was observed on Mastodon (infosec.exchange) shortly after disclosure. AusCERT published a bulletin (ESB-2026.10422) and Tenable released a Nessus detection plugin (ID 342607). Coverage was generally focused on the SAML pre-authentication attack surface as the most impactful exploitation scenario.