# CVE-2026-78689: NGINX njs XML namespace parser out-of-bounds write

Source: https://junglewise.ai/threats/cve-2026-78689-nginx-njs-xml-namespace-parser-out-of-bounds-write  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-78689 · Severity: high · CVSS 8.1 · Published 2026-09-02

NGINX JavaScript (njs) module contains a memory corruption vulnerability in its XML processing that can be exploited by sending malicious SAML or XML messages. An attacker can crash NGINX worker processes or cause memory leaks, leading to service disruption. The NGINX SAML reference implementation is particularly affected, as it processes untrusted XML namespace prefixes before verifying message signatures.

Vendors: [NGINX](https://junglewise.ai/threats/vendors/nginx).

## Quick answers

**Is CVE-2026-78689 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78689 being exploited in the wild.

**How severe is CVE-2026-78689?** High severity, with a CVSS score of 8.1, published 2 September 2026.

**Which products and versions are affected?** Nginx-Saml reference implementation affected.

**Is there a fix for CVE-2026-78689?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-78689 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-78689?** Check whether you run Nginx-Saml at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an out-of-bounds write in the XML module's namespace prefix list parser, reachable via the xml.exclusiveC14n() method. When an externally controlled XML namespace prefix list is passed to this method, a crafted prefix causes a heap buffer overflow. With the njs engine (default), this corrupts adjacent heap objects and crashes the worker; with QuickJS engine, it additionally leaks memory on each call. The nginxinc/nginx-saml reference implementation is affected because it reads the InclusiveNamespaces/@PrefixList from untrusted SAML messages and passes it to xml.exclusiveC14n() before signature verification. No authentication is required; network-reachable via SAML/XML processing. Code execution has not been demonstrated but cannot be ruled out depending on platform-specific memory layout conditions.

## Affected products

- NGINX njs all versions with XML module
- NGINX nginx-saml reference implementation affected

## Timeline

- 2026-09-02: disclosed: Advisory published