CVE-2026-57435

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri’s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, Nokogiri::XML::Attr#value= could free the underlying native child node while the wrapper remained reachable through the document node cache. A later use of the freed child node or a Ruby GC mark could dereference an invalid pointer, causing an invalid read and a possible segfault. This vulnerability is fixed in 1.19.4.

Score

CVSS 3.1 7.5 High

Status

Analyzed - security-advisories@github.com

Published

2026-06-25

Last modified

2026-10-25

Weaknesses

CWE-416, CWE-825

Affected products

• Nokogiri (Nokogiri)
• Nokogiri (Sparklemotion)

References

• https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-phwj-rprq-35pp