Vulnerability-Lookup

CVE-2026-101019 (GCVE-0-2026-101019)

Vulnerability from cvelistv5 – Published: 2026-10-14 14:40 – Updated: 2026-10-15 16:43

Title

NGINX ngx_http_js_module vulnerability

Summary

Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference. The $attrs getter may return a value derived only from the first attribute child. This may allow an unauthenticated attacker that invests significant effort in obtaining a genuinely signed document to skip validation while signature verification succeeds. An nginx-saml deployment is a confirmed affected consumer when run with the built-in njs backend. Impact In affected signed-XML consumers, an unauthenticated attacker can cause security-relevant attributes to appear absent or truncated while signature verification succeeds. In nginx-saml, this can bypass expiry, Destination, and request-correlation checks, enabling replay or acceptance of a response outside its intended context. It does not permit signature or identity forgery, or a direct availability impact. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

8.3 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 15:54 UTC

CWE

CWE-436 - Interpretation Conflict

Assigner

f5 CNA under the mitre root

CNA scorecard B 85/100 over 36 records in the last 180 days details

References

1 reference

URL	Tags
https://my.f5.com/manage/s/article/K000162615	vendor-advisory

Impacted products

1 product

Vendor	Product	Version	CPE status
F5	NGINX JavaScript	Affected: 0.7.10 , < 1.0.2 (custom)	guessed

Date Public

2023-01-01 00:00

Credits

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-101019",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T15:54:18.777169Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T16:43:46.354Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "ngx_http_js_module"
          ],
          "product": "NGINX JavaScript",
          "vendor": "F5",
          "versions": [
            {
              "lessThan": "1.0.2",
              "status": "affected",
              "version": "0.7.10",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "F5"
        }
      ],
      "datePublic": "2023-01-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Description\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eNGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference. The $attrs getter may return a value derived only from the first attribute child. This may allow an unauthenticated attacker that invests significant effort in obtaining a genuinely signed document to skip validation while signature verification succeeds. An nginx-saml deployment is a confirmed affected consumer when run with the built-in njs backend.\u003cbr\u003e\u003c/span\u003e\u003cbr\u003eImpact\u003cbr\u003eIn affected signed-XML consumers, an unauthenticated attacker can cause security-relevant attributes to appear absent or truncated while signature verification succeeds. In nginx-saml, this can bypass expiry, Destination, and request-correlation checks, enabling replay or acceptance of a response outside its intended context. It does not permit signature or identity forgery, or a direct availability impact.\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThere is no control plane exposure; this is a data plane issue only.\u003c/span\u003e\n\n\u003cbr\u003e\u003cbr\u003e\u0026nbsp;Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
            }
          ],
          "value": "Description\nNGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference. The $attrs getter may return a value derived only from the first attribute child. This may allow an unauthenticated attacker that invests significant effort in obtaining a genuinely signed document to skip validation while signature verification succeeds. An nginx-saml deployment is a confirmed affected consumer when run with the built-in njs backend.\n\nImpact\nIn affected signed-XML consumers, an unauthenticated attacker can cause security-relevant attributes to appear absent or truncated while signature verification succeeds. In nginx-saml, this can bypass expiry, Destination, and request-correlation checks, enabling replay or acceptance of a response outside its intended context. It does not permit signature or identity forgery, or a direct availability impact.\u00a0There is no control plane exposure; this is a data plane issue only.\n\n\n\n\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-267",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-267 Leverage Alternate Encoding"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436 Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T14:40:29.685Z",
        "orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
        "shortName": "f5"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://my.f5.com/manage/s/article/K000162615"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "NGINX ngx_http_js_module vulnerability",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eApplications processing signed XML should reject DTD-bearing input before calling xml.parse(). The check must cover the complete document after decoding its accepted input encoding; a parser-level DTD prohibition is preferable to a raw byte search for \"\u0026lt;!DOCTYPE\". \u003cbr\u003e\u003cbr\u003eApplications should also treat absent security-relevant attributes as validation failures rather than optional values. nginx-saml deployments should explicitly validate Destination, request correlation when unsolicited SSO is not intended, assertion validity, bearer SubjectConfirmation, Recipient, and SubjectConfirmationData InResponseTo.\u003c/span\u003e"
            }
          ],
          "value": "Applications processing signed XML should reject DTD-bearing input before calling xml.parse(). The check must cover the complete document after decoding its accepted input encoding; a parser-level DTD prohibition is preferable to a raw byte search for \"\u003c!DOCTYPE\". \n\nApplications should also treat absent security-relevant attributes as validation failures rather than optional values. nginx-saml deployments should explicitly validate Destination, request correlation when unsolicited SSO is not intended, assertion validity, bearer SubjectConfirmation, Recipient, and SubjectConfirmationData InResponseTo."
        }
      ],
      "x_generator": {
        "engine": "F5 SIRTBot v1.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
    "assignerShortName": "f5",
    "cveId": "CVE-2026-101019",
    "datePublished": "2026-10-14T14:40:29.685Z",
    "dateReserved": "2026-09-30T21:56:14.632Z",
    "dateUpdated": "2026-10-15T16:43:46.354Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-101019",
      "date": "2026-11-11",
      "epss": "0.0021",
      "percentile": "0.11288"
    },
    "microsoft_vex": {
      "current_release_date": "2026-11-02T01:48:16.000Z",
      "cve": "CVE-2026-101019",
      "id": "msrc_CVE-2026-101019",
      "initial_release_date": "2026-10-17T01:07:49.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "NGINX ngx_http_js_module vulnerability",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-101019.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unknown",
                "modules": [
                  "ngx_http_js_module"
                ],
                "product": "NGINX JavaScript",
                "vendor": "F5",
                "versions": [
                  {
                    "lessThan": "1.0.2",
                    "status": "affected",
                    "version": "0.7.10",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "f5sirt@f5.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Description\nNGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference. The $attrs getter may return a value derived only from the first attribute child. This may allow an unauthenticated attacker that invests significant effort in obtaining a genuinely signed document to skip validation while signature verification succeeds. An nginx-saml deployment is a confirmed affected consumer when run with the built-in njs backend.\n\nImpact\nIn affected signed-XML consumers, an unauthenticated attacker can cause security-relevant attributes to appear absent or truncated while signature verification succeeds. In nginx-saml, this can bypass expiry, Destination, and request-correlation checks, enabling replay or acceptance of a response outside its intended context. It does not permit signature or identity forgery, or a direct availability impact.\u00a0There is no control plane exposure; this is a data plane issue only.\n\n\n\n\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
          }
        ],
        "id": "CVE-2026-101019",
        "lastModified": "2026-10-15T17:17:08.083",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 4.2,
              "source": "f5sirt@f5.com",
              "type": "Secondary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.3,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "LOW",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "f5sirt@f5.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-101019",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T15:54:18.777169Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-14T15:17:01.697",
        "references": [
          {
            "source": "f5sirt@f5.com",
            "url": "https://my.f5.com/manage/s/article/K000162615"
          }
        ],
        "sourceIdentifier": "f5sirt@f5.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-436"
              }
            ],
            "source": "f5sirt@f5.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-10-15T14:04:15Z",
      "cve": "CVE-2026-101019",
      "id": "CVE-2026-101019",
      "initial_release_date": "2026-10-15T14:04:15Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-101019",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/2026/cve-2026-101019.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-101019",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-15T15:54:18.777169Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-15T16:38:37.939Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unknown",
              "modules": [
                "ngx_http_js_module"
              ],
              "product": "NGINX JavaScript",
              "vendor": "F5",
              "versions": [
                {
                  "lessThan": "1.0.2",
                  "status": "affected",
                  "version": "0.7.10",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "F5"
            }
          ],
          "datePublic": "2023-01-01T00:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Description\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eNGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference. The $attrs getter may return a value derived only from the first attribute child. This may allow an unauthenticated attacker that invests significant effort in obtaining a genuinely signed document to skip validation while signature verification succeeds. An nginx-saml deployment is a confirmed affected consumer when run with the built-in njs backend.\u003cbr\u003e\u003c/span\u003e\u003cbr\u003eImpact\u003cbr\u003eIn affected signed-XML consumers, an unauthenticated attacker can cause security-relevant attributes to appear absent or truncated while signature verification succeeds. In nginx-saml, this can bypass expiry, Destination, and request-correlation checks, enabling replay or acceptance of a response outside its intended context. It does not permit signature or identity forgery, or a direct availability impact.\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThere is no control plane exposure; this is a data plane issue only.\u003c/span\u003e\n\n\u003cbr\u003e\u003cbr\u003e\u0026nbsp;Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
                }
              ],
              "value": "Description\nNGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference. The $attrs getter may return a value derived only from the first attribute child. This may allow an unauthenticated attacker that invests significant effort in obtaining a genuinely signed document to skip validation while signature verification succeeds. An nginx-saml deployment is a confirmed affected consumer when run with the built-in njs backend.\n\nImpact\nIn affected signed-XML consumers, an unauthenticated attacker can cause security-relevant attributes to appear absent or truncated while signature verification succeeds. In nginx-saml, this can bypass expiry, Destination, and request-correlation checks, enabling replay or acceptance of a response outside its intended context. It does not permit signature or identity forgery, or a direct availability impact.\u00a0There is no control plane exposure; this is a data plane issue only.\n\n\n\n\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-267",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-267 Leverage Alternate Encoding"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            },
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "baseScore": 8.3,
                "baseSeverity": "HIGH",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "LOW",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-436",
                  "description": "CWE-436 Interpretation Conflict",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-14T14:40:29.685Z",
            "orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
            "shortName": "f5"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://my.f5.com/manage/s/article/K000162615"
            }
          ],
          "source": {
            "discovery": "INTERNAL"
          },
          "title": "NGINX ngx_http_js_module vulnerability",
          "workarounds": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eApplications processing signed XML should reject DTD-bearing input before calling xml.parse(). The check must cover the complete document after decoding its accepted input encoding; a parser-level DTD prohibition is preferable to a raw byte search for \"\u0026lt;!DOCTYPE\". \u003cbr\u003e\u003cbr\u003eApplications should also treat absent security-relevant attributes as validation failures rather than optional values. nginx-saml deployments should explicitly validate Destination, request correlation when unsolicited SSO is not intended, assertion validity, bearer SubjectConfirmation, Recipient, and SubjectConfirmationData InResponseTo.\u003c/span\u003e"
                }
              ],
              "value": "Applications processing signed XML should reject DTD-bearing input before calling xml.parse(). The check must cover the complete document after decoding its accepted input encoding; a parser-level DTD prohibition is preferable to a raw byte search for \"\u003c!DOCTYPE\". \n\nApplications should also treat absent security-relevant attributes as validation failures rather than optional values. nginx-saml deployments should explicitly validate Destination, request correlation when unsolicited SSO is not intended, assertion validity, bearer SubjectConfirmation, Recipient, and SubjectConfirmationData InResponseTo."
            }
          ],
          "x_generator": {
            "engine": "F5 SIRTBot v1.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
        "assignerShortName": "f5",
        "cveId": "CVE-2026-101019",
        "datePublished": "2026-10-14T14:40:29.685Z",
        "dateReserved": "2026-09-30T21:56:14.632Z",
        "dateUpdated": "2026-10-15T16:43:46.354Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

BELL-CVE-2026-101019 (CVE-2026-101019)

Vulnerability from osv_bellsoft – Published: 2026-10-20 06:09 – Updated: 2026-10-22 06:03 – Source website

Severity

6.5 (Medium)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

References

URL

Type

https://docs.bell-sw.com/security/cves/CVE-2026-101019

ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Alpaquita:23",
        "name": "nginx",
        "purl": "pkg:apk/alpaquita/nginx?arch=source\u0026distro=23"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.22.1-r0"
            },
            {
              "fixed": "1.30.6-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Alpaquita:23",
        "name": "nginx-base",
        "purl": "pkg:apk/alpaquita/nginx-base?arch=source\u0026distro=23"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.30.3-r0"
            },
            {
              "fixed": "1.30.6-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Alpaquita:25",
        "name": "nginx",
        "purl": "pkg:apk/alpaquita/nginx?arch=source\u0026distro=25"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.28.0-r3"
            },
            {
              "fixed": "1.30.6-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Alpaquita:25",
        "name": "nginx-base",
        "purl": "pkg:apk/alpaquita/nginx-base?arch=source\u0026distro=25"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.30.3-r0"
            },
            {
              "fixed": "1.30.6-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Alpaquita:stream",
        "name": "nginx",
        "purl": "pkg:apk/alpaquita/nginx?arch=source\u0026distro=stream"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.22.1-r0"
            },
            {
              "fixed": "1.30.6-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Alpaquita:stream",
        "name": "nginx-base",
        "purl": "pkg:apk/alpaquita/nginx-base?arch=source\u0026distro=stream"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.30.3-r0"
            },
            {
              "fixed": "1.30.6-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "BellSoft Hardened Containers:23",
        "name": "nginx-base",
        "purl": "pkg:apk/bellsoft-hardened-containers/nginx-base?arch=source\u0026distro=23"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.30.3-r0"
            },
            {
              "fixed": "1.30.6-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "BellSoft Hardened Containers:25",
        "name": "nginx-base",
        "purl": "pkg:apk/bellsoft-hardened-containers/nginx-base?arch=source\u0026distro=25"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.30.3-r0"
            },
            {
              "fixed": "1.30.6-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "BellSoft Hardened Containers:stream",
        "name": "nginx-base",
        "purl": "pkg:apk/bellsoft-hardened-containers/nginx-base?arch=source\u0026distro=stream"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.30.3-r0"
            },
            {
              "fixed": "1.30.6-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "id": "BELL-CVE-2026-101019",
  "modified": "2026-10-22T06:03:20.729784Z",
  "published": "2026-10-20T06:09:24.581768Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://docs.bell-sw.com/security/cves/CVE-2026-101019"
    }
  ],
  "schema_version": "1.7.4",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-101019"
  ]
}

CERTFR-2026-AVI-1341

Vulnerability from certfr_avis - Published: 2026-10-19 - Updated: 2026-10-19

De multiples vulnérabilités ont été découvertes dans les produits F5. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
F5	NGINX App Protect WAF	NGINX App Protect WAF versions 4.x
F5	NGINX App Protect DoS	NGINX App Protect DoS versions 4.x
F5	NGINX Plus	NGINX Plus versions antérieures à 37.1.0.1 et 37.0.5.1
F5	NGINX Ingress Controller	NGINX Ingress Controller versions antérieures à 5.7.0
F5	NGINX Ingress Controller	NGINX Ingress Controller versions 2026-lts-r3 - 2026-lts-r8
F5	NGINX JavaScript (njs)	NGINX Javascript antérieures à 1.0.2
F5	NGINX Open Source	NGINX Open Source versions 1.31.x antérieures à 1.31.7
F5	F5 WAF for NGINX	F5 WAF for NGINX versions 5.x antérieures à 5.14.2 et 5.16.0
F5	NGINX Instance Manager	NGINX Instance Manager versions 2.x antérieures à 2.24.0
F5	NGINX Open Source	NGINX Open Source versions antérieures à 1.30.6
F5	NGINX Gateway Fabric	NGINX Gateway Fabric versions antérieures à 2.8.0
F5	F5 DoS for NGINX	F5 DoS for NGINX versions 4.x antérieures à 4.11.0
F5	NGINX App Protect WAF	NGINX App Protect WAF versions 5.x

References

Title

Publication Time

FKIE_CVE-2026-101019

Vulnerability from fkie_nvd - Published: 2026-10-14 15:17 - Updated: 2026-10-15 17:17

Severity

6.5 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Summary

References

	URL	Tags
	f5sirt@f5.com	https://my.f5.com/manage/s/article/K000162615

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "ngx_http_js_module"
          ],
          "product": "NGINX JavaScript",
          "vendor": "F5",
          "versions": [
            {
              "lessThan": "1.0.2",
              "status": "affected",
              "version": "0.7.10",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "f5sirt@f5.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Description\nNGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference. The $attrs getter may return a value derived only from the first attribute child. This may allow an unauthenticated attacker that invests significant effort in obtaining a genuinely signed document to skip validation while signature verification succeeds. An nginx-saml deployment is a confirmed affected consumer when run with the built-in njs backend.\n\nImpact\nIn affected signed-XML consumers, an unauthenticated attacker can cause security-relevant attributes to appear absent or truncated while signature verification succeeds. In nginx-saml, this can bypass expiry, Destination, and request-correlation checks, enabling replay or acceptance of a response outside its intended context. It does not permit signature or identity forgery, or a direct availability impact.\u00a0There is no control plane exposure; this is a data plane issue only.\n\n\n\n\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
    }
  ],
  "id": "CVE-2026-101019",
  "lastModified": "2026-10-15T17:17:08.083",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 4.2,
        "source": "f5sirt@f5.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.3,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "f5sirt@f5.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-101019",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-15T15:54:18.777169Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-14T15:17:01.697",
  "references": [
    {
      "source": "f5sirt@f5.com",
      "url": "https://my.f5.com/manage/s/article/K000162615"
    }
  ],
  "sourceIdentifier": "f5sirt@f5.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-436"
        }
      ],
      "source": "f5sirt@f5.com",
      "type": "Secondary"
    }
  ]
}

GHSA-FVF3-54P5-JG2M

Vulnerability from github – Published: 2026-10-14 15:32 – Updated: 2026-10-14 15:32

Details

Impact In affected signed-XML consumers, an unauthenticated attacker can cause security-relevant attributes to appear absent or truncated while signature verification succeeds. In nginx-saml, this can bypass expiry, Destination, and request-correlation checks, enabling replay or acceptance of a response outside its intended context. It does not permit signature or identity forgery, or a direct availability impact. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

8.3 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-101019"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-436"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-14T15:17:01Z",
    "severity": "HIGH"
  },
  "details": "Description\nNGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference. The $attrs getter may return a value derived only from the first attribute child. This may allow an unauthenticated attacker that invests significant effort in obtaining a genuinely signed document to skip validation while signature verification succeeds. An nginx-saml deployment is a confirmed affected consumer when run with the built-in njs backend.\n\nImpact\nIn affected signed-XML consumers, an unauthenticated attacker can cause security-relevant attributes to appear absent or truncated while signature verification succeeds. In nginx-saml, this can bypass expiry, Destination, and request-correlation checks, enabling replay or acceptance of a response outside its intended context. It does not permit signature or identity forgery, or a direct availability impact.\u00a0There is no control plane exposure; this is a data plane issue only.\n\n\n\n\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
  "id": "GHSA-fvf3-54p5-jg2m",
  "modified": "2026-10-14T15:32:22Z",
  "published": "2026-10-14T15:32:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101019"
    },
    {
      "type": "WEB",
      "url": "https://my.f5.com/manage/s/article/K000162615"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

MSRC_CVE-2026-101019

Vulnerability from csaf_microsoft - Published: 2026-10-17 01:07 - Updated: 2026-11-02 01:48

Summary

NGINX ngx_http_js_module vulnerability

Scope

1 vulnerability in this advisory, including CVE-2026-101019.

CVE-2026-101019

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Fixed: 1 product Known affected: 1 product

https://learn.microsoft.com/en-us/azure/azure-linux/tutoria…

Open the full advisory

UBUNTU-CVE-2026-101019 (CVE-2026-101019)

Vulnerability from osv_ubuntu – Published: 2026-10-14 15:17 – Updated: 2026-10-28 17:50 – Source website

Details

Severity

6.5 (Medium)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

8.3 (High)


                    
                      CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-101019	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-101019	REPORT
	https://my.f5.com/manage/s/article/K000162615	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libnginx-mod-http-js",
            "binary_version": "0.8.2-1ubuntu1"
          },
          {
            "binary_name": "libnginx-mod-stream-js",
            "binary_version": "0.8.2-1ubuntu1"
          },
          {
            "binary_name": "njs",
            "binary_version": "0.8.2-1ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "libnginx-mod-js",
        "purl": "pkg:deb/ubuntu/libnginx-mod-js@0.8.2-1ubuntu1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.7.12-2",
        "0.8.2-1ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libnginx-mod-http-js",
            "binary_version": "1.0.0-3"
          },
          {
            "binary_name": "libnginx-mod-stream-js",
            "binary_version": "1.0.0-3"
          },
          {
            "binary_name": "njs",
            "binary_version": "1.0.0-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.10",
        "name": "libnginx-mod-js",
        "purl": "pkg:deb/ubuntu/libnginx-mod-js@1.0.0-3?arch=source\u0026distro=stonking"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.9.4-1build2",
        "0.9.9-2",
        "1.0.0-1",
        "1.0.0-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libnginx-mod-http-js",
            "binary_version": "0.9.4-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libnginx-mod-stream-js",
            "binary_version": "0.9.4-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "njs",
            "binary_version": "0.9.4-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:26.04:LTS",
        "name": "libnginx-mod-js",
        "purl": "pkg:deb/ubuntu/libnginx-mod-js@0.9.4-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.9.1-1ubuntu2",
        "0.9.1-1ubuntu3",
        "0.9.4-1~build1",
        "0.9.4-1",
        "0.9.4-1build1",
        "0.9.4-1build2",
        "0.9.4-1ubuntu0.1~esm1"
      ]
    }
  ],
  "aliases": [],
  "details": "Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an explicitly present attribute containing an internal entity reference. The $attrs getter may return a value derived only from the first attribute child. This may allow an unauthenticated attacker that invests significant effort in obtaining a genuinely signed document to skip validation while signature verification succeeds. An nginx-saml deployment is a confirmed affected consumer when run with the built-in njs backend. Impact In affected signed-XML consumers, an unauthenticated attacker can cause security-relevant attributes to appear absent or truncated while signature verification succeeds. In nginx-saml, this can bypass expiry, Destination, and request-correlation checks, enabling replay or acceptance of a response outside its intended context. It does not permit signature or identity forgery, or a direct availability impact.\u00a0There is no control plane exposure; this is a data plane issue only. \u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
  "id": "UBUNTU-CVE-2026-101019",
  "modified": "2026-10-28T17:50:26Z",
  "published": "2026-10-14T15:17:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-101019"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101019"
    },
    {
      "type": "REPORT",
      "url": "https://my.f5.com/manage/s/article/K000162615"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-101019"
  ]
}

WID-SEC-W-2026-3948

Vulnerability from csaf_certbund - Published: 2026-10-14 22:00 - Updated: 2026-11-10 23:00

Summary

NGINX: Mehrere Schwachstellen

Severity

Hoch

Scope

11 vulnerabilities in this advisory, including CVE-2026-101019.

CVE-2026-101019

Known affected: 6 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-101019 (GCVE-0-2026-101019)

BELL-CVE-2026-101019 (CVE-2026-101019)

CERTFR-2026-AVI-1341

Solutions

FKIE_CVE-2026-101019

GHSA-FVF3-54P5-JG2M

MSRC_CVE-2026-101019

UBUNTU-CVE-2026-101019 (CVE-2026-101019)

WID-SEC-W-2026-3948

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour