{
  "cveId": "CVE-2026-101019",
  "url": "https://patchblox.com/security/cve/CVE-2026-101019",
  "summary": "CVE-2026-101019 is fixed in 4 products on 1 platform, first by DEBIAN-CVE-2026-101019, released October 24, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "NGINX ngx_http_js_module vulnerability",
  "description": "Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference. The $attrs getter may return a value derived only from the first attribute child. This may allow an unauthenticated attacker that invests significant effort in obtaining a genuinely signed document to skip validation while signature verification succeeds. An nginx-saml deployment is a confirmed affected consumer when run with the built-in njs backend.  Impact In affected signed-XML consumers, an unauthenticated attacker can cause security-relevant attributes to appear absent or truncated while signature verification succeeds. In nginx-saml, this can bypass expiry, Destination, and request-correlation checks, enabling replay or acceptance of a response outside its intended context. It does not permit signature or identity forgery, or a direct availability impact.\u00A0There is no control plane exposure; this is a data plane issue only.    \u00A0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
  "published": "2026-10-14T15:17:01Z",
  "severity": "Moderate",
  "cvss": 6.5,
  "cwe": "Interpretation Conflict",
  "epss": 0.0021,
  "epssPercentile": 0.11239,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-101019",
  "fixes": [
    {
      "platform": "linux",
      "product": "libnginx-mod-js",
      "release": "Debian 14",
      "fixedVersion": "1.0.2-1",
      "fix": "DEBIAN-CVE-2026-101019",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-101019",
      "released": "2026-10-24T13:25:57Z"
    },
    {
      "platform": "linux",
      "product": "nginx-mod-njs",
      "release": "amzn 2023",
      "fixedVersion": "1.0.2-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-3300",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3300",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "nginx-mod-njs-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.0.2-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-3300",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3300",
      "released": "2026-11-07T01:06:07Z"
    },
    {
      "platform": "linux",
      "product": "nginx-mod-njs-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "1.0.2-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-3300",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3300",
      "released": "2026-11-07T01:06:07Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}