An unauthenticated remote code execution and denial of service vulnerability exists in the NGINX JavaScript (njs) XML module, requiring immediate patching of affected instances.

This is a heap-based buffer overflow (CWE-122) triggered within the xml.exclusiveC14n() method via a crafted XML namespace prefix list. An unauthenticated attacker can exploit this by sending a malicious SAML message, which is processed by the application before signature verification occurs.

Successful exploitation leads to a denial of service through worker crashes or memory exhaustion, significantly impacting service availability. While code execution has not been explicitly demonstrated, the nature of the heap corruption poses a severe risk to data integrity and system security. With a CVSS score of 8.1, this vulnerability represents a high-severity threat to any infrastructure relying on NGINX for SAML-based authentication.

Immediate Action: Update F5 NGINX JavaScript (njs) to version 1.0.1 or later as specified in the official vendor security advisory.

Proactive Monitoring: Monitor NGINX error logs for repeated worker process crashes or unexpected memory spikes that may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict XML schema validation rules to block malformed or suspicious SAML requests before they reach the NGINX backend.

Public Exploit Available: No

The vulnerability in the njs XML module is a critical flaw that exposes authentication workflows to potential compromise. Because the vulnerability is reachable by unauthenticated attackers during the early stages of SAML processing, organizations should prioritize patching all affected NGINX deployments immediately. Delaying updates increases the window of exposure to memory corruption and potential service disruption.