CVE-2026-57438 Details
Description
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, XInclude substitution performed by Nokogiri::XML::Node#do_xinclude replaced each <xi:include> in place, freeing the include node along with its children (such as <xi:fallback> and its descendants) and any namespaces declared on them. If an application had already exposed one of those nodes or namespaces to Ruby, the corresponding Ruby object was left pointing at freed memory. Using the object could result in invalid reads or writes to memory. This vulnerability is fixed in 1.19.4.
A use-after-free vulnerability has been identified in Nokogiri versions prior to 1.19.4, specifically in the XInclude processing of the Nokogiri::XML::Node#do_xinclude method. The issue arises because the XInclude substitution replaces each <xi:include> node in place, freeing the include node along with its children, such as <xi:fallback>, and any associated namespaces. If an application had previously exposed one of these nodes or namespaces to Ruby, the corresponding Ruby object would be left referencing freed memory, potentially leading to invalid memory reads or writes. This vulnerability is present only in the CRuby implementation of Nokogiri, not in JRuby.
Users are advised to upgrade to Nokogiri version 1.19.4 or later. For those using earlier versions, XInclude processing can be safely performed at parse time using the 'xinclude' parse option, rather than calling '#do_xinclude' on a document that has already been traversed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-wfpw-mmfh-qq69 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nokogiri nokogiri | < 1.19.4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | New CVE Received | [email protected] |