CVE-2026-57435 Details
Description
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri’s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, Nokogiri::XML::Attr#value= could free the underlying native child node while the wrapper remained reachable through the document node cache. A later use of the freed child node or a Ruby GC mark could dereference an invalid pointer, causing an invalid read and a possible segfault. This vulnerability is fixed in 1.19.4.
A use-after-free vulnerability has been identified in Nokogiri, a popular XML and HTML library for Ruby. This issue arises in versions prior to 1.19.4, where the CRuby native extension could leave a Ruby wrapper referencing freed memory when an XML attribute value was changed. If Ruby code had previously accessed a child node of the attribute, the method Nokogiri::XML::Attr#value= could deallocate the associated native child node while the Ruby wrapper remained accessible through the document node cache. Subsequent access to the freed child node or a Ruby garbage collection mark could lead to dereferencing an invalid pointer, causing an erroneous read and potentially a segmentation fault. This vulnerability is not present in JRuby.
Upgrade to Nokogiri version 1.19.4 or later. As a temporary workaround, avoid directly accessing attribute child nodes before modifying the attribute's value.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-phwj-rprq-35pp | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
| CWE-825 | Expired Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nokogiri nokogiri | < 1.19.4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | New CVE Received | [email protected] |