CVE-2026-57437 Details

A use-after-free vulnerability has been identified in the Nokogiri library for Ruby, specifically in the XML processing component. This issue arises in versions prior to 1.19.4, where the Nokogiri::XML::XPathContext did not properly manage the lifecycle of its source document, allowing it to be garbage collected while the context was still in use. This could lead to reading invalid memory and potentially causing a segmentation fault. The vulnerability is only exploitable when application code directly creates an XPathContext and allows the associated document to become unreachable, all while continuing to use the context. Notably, this issue does not affect the standard document search methods, such as Document#xpath or #css, and cannot be triggered by malicious document input.

Users are advised to upgrade to Nokogiri version 1.19.4 or later. As a temporary workaround, ensure that the source document remains referenced for the duration of any XPathContext created from it. The standard Document#xpath, #css, and related search methods already maintain this reference and are not affected by the vulnerability.