CVE-2026-126064

Description

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, the CRuby native extension can leave Ruby wrappers pointing to freed memory when Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang= replaces an existing attribute value after code has accessed the attribute's child nodes. Replacing the value frees native child nodes while their wrappers remain reachable, and later use of those wrappers can cause an invalid read or process segfault. JRuby is not affected. This issue is fixed in version 1.19.5.

References

https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-3w22-6jfg-527w

https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5

https://github.com/sparklemotion/nokogiri/pull/3752

https://github.com/sparklemotion/nokogiri/commit/feaed3c8c9bd9d81d064d4ca09b16044cd705d6f

https://github.com/sparklemotion/nokogiri/commit/b15b518db9fd15fd6b046f73d1439c282e5cc425

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-122836

Details

Source: Mitre, NVD

Named Vulnerability: GHSA-3w22-6jfg-527w

Risk Information

CVSS v2

CVSS v3

CVSS v4

EPSS