CVE-2026-57236 Details
Description
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, calling Document#encoding= with an invalid encoding (e.g., a non-string, or a string containing a null byte) raises an exception, but only after freeing the document's current encoding string without replacing it. The document is left referencing freed memory, so the next call to Document#encoding reads invalid memory, which can cause a segfault or leak freed bytes into a Ruby String. Affects the CRuby (libxml2) implementation only; JRuby is not affected. This vulnerability is fixed in 1.19.4.
A use-after-free vulnerability has been identified in Nokogiri, a popular XML and HTML library for Ruby. This issue affects versions prior to 1.19.4 in the CRuby (libxml2) implementation, while JRuby users are not impacted. The vulnerability arises when the `Document#encoding=` method is called with an invalid encoding, such as a non-string value or a string containing a null byte. Although this raises an exception, it first frees the document's current encoding string without replacing it. As a result, the document ends up referencing deallocated memory. The subsequent call to `Document#encoding` can read invalid memory, potentially causing a segmentation fault or leaking freed bytes into a Ruby String.
Users are advised to upgrade to Nokogiri version 1.19.4 or later. If an upgrade is not possible, avoid passing attacker-controlled values to the `Document#encoding=` method. Applications that only use developer-authored encodings are not directly exposed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5v8h-3h3q-446p | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nokogiri nokogiri | < 1.19.4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | New CVE Received | [email protected] |