BSD Portsnjs -- heap buffer overflow in XML exclusive canonicalization
· CVE-2026-78689 · VuXML entry
F5 reports: A flaw in the NGINX JavaScript XML module allows an out-of-bounds write when xml.exclusiveC14n() processes a crafted XML namespace prefix list. This may lead to worker process crashes, heap corruption or memory disclosure. The NGINX SAML reference implementation is affected because it processes SAML data before signature verification.
Affected versions
- njs, libnjs, nginx-module-njs < 1.0.1
- nginx-full < 1.30.4_7,3
By system
3 still vulnerable, 4 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | lang/njs | 0.8.5 | vulnerable since 2026-09-03 | |
| OpenBSD | lang/njs | 0.9.1p0 | in range, by version | |
| NetBSD | lang/njs | 0.9.1nb3 | not listed | |
| FreeBSD | lang/njs | 1.0.2 | fixed | |
| FreeBSD | devel/libnjs | 1.0.2 | fixed | |
| NetBSD | devel/libnjs | 0.9.1nb3 | not listed | |
| DragonFly | devel/libnjs | 0.8.5 | vulnerable since 2026-09-03 | |
| FreeBSD | www/nginx-module-njs | 1.0.2 | fixed | |
| DragonFly | www/nginx-full | 1.26.3_3,3 | vulnerable since 2026-09-03 | |
| FreeBSD | www/nginx-full | 1.30.6_6,3 | fixed |