This vulnerability lies in the XML module's namespace prefix list parser used by the xml.exclusiveC14n() method in NGINX JavaScript (njs) and QuickJS engines. A crafted prefix list triggers an out‑of‑bounds write beyond a heap allocation, which can crash an NGINX worker or cause memory growth. The defect may lead to denial of service and, depending on platform and conditions, could potentially enable code execution. The flaw is a classic out‑of‑bounds memory write (CWE‑122).

The affected products are F5's NGINX JavaScript implementations that use the njs or QuickJS engines. Any NGINX build that invokes xml.exclusiveC14n() with an externally controlled XML namespace prefix list is vulnerable. This includes the official nginxinc/nginx-saml reference implementation during SAML signature verification, where the InclusiveNamespaces/@PrefixList value is read from an untrusted SAML message before the signature is checked. No specific version numbers are listed, so all installations that have not upgraded to the latest patched releases are potentially affected. The issue is confined to the data plane; there is no control‑plane exposure.

The CVSS score of 9.2 marks this as critical. EPSS is not available, so the current probability of exploitation is unknown, but the lack of evidence does not preclude exploitation. The vulnerability is not listed in CISA’s KEV catalog. An unauthenticated remote attacker could deliver a malicious SAML Response, Assertion, LogoutRequest or LogoutResponse, or otherwise inject a crafted XML namespace prefix list via an HTTP request. This can cause the NGINX worker to crash repeatedly or grow memory, leading to denial of service. While code execution has not been demonstrated, the out‑of‑bounds write could be leveraged on certain platforms if attack conditions are met.