The NGINX JavaScript (njs) XML module contains a flaw where entity‑backed XML attributes are exposed inconsistently with libxml2 canonicalization. During canonicalization, attribute getters may return undefined for explicitly present attributes that reference internal entities, and the attributes list may be populated from only the first attribute child. As a result, an unauthenticated attacker who supplies a carefully crafted signed XML document can cause security‑relevant attributes to appear absent or truncated while the signature still verifies successfully. This allows the attacker to bypass checks on expiration, Destination, and request correlation, enabling replay or acceptance of responses outside their intended context. The defect does not enable signature or identity forgery, nor does it cause availability issues, and it only affects data plane processing.

The vulnerability affects systems running the F5 NGINX JavaScript (njs) module, specifically NGINX configurations that employ the njs XML module. Deployments using nginx‑saml are confirmed affected consumers when operating with the built‑in njs backend. No specific version information is provided; all supported builds of the njs module prior to a vendor patch or upgrade are potentially impacted.

The CVSS score of 8.3 indicates high severity, and the EPSS score is < 1%, indicating a very low probability of exploitation. It is not listed in CISA’s KEV catalog. The attack vector is data plane: an attacker must form a signed XML payload that reaches the target NGINX instance and is parsed by the njs XML module. The attacker does not need authentication to the service and must invest effort to craft a valid XML document with internal entity references. The impact is limited to verification bypass and potential replay attacks in consumer services such as nginx‑saml.