CVE-2026-57436 Details
Description
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::Document#root= validated only that the new root was a Nokogiri::XML::Node, allowing a DTD node to be set as the document root. The result is a heap use-after-free during garbage collection or finalization, leading to an invalid memory read or potentially a segfault. This vulnerability is fixed in 1.19.4.
A heap use-after-free vulnerability has been identified in Nokogiri versions prior to 1.19.4. The issue arises in the Nokogiri::XML::Document#root= method, which improperly validated the new root node. This flaw allowed a DTD node to be set as the document root, leading to a use-after-free condition during garbage collection. The vulnerability could cause an invalid memory read or a segmentation fault. This issue affects only the CRuby implementation of Nokogiri.
Users are advised to upgrade to Nokogiri version 1.19.4 or later. Applications that cannot upgrade should avoid assigning a DTD or any non-element node as the document root.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-wjv4-x9w8-wm3h | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nokogiri nokogiri | < 1.19.4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | New CVE Received | [email protected] |