Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::XPathContext did not keep its source document alive for garbage collection. If an XPathContext outlived its document and the document was collected, evaluating an XPath expression could read invalid memory and potentially segfault. This is only reachable when application code constructs an XPathContext directly and lets the document become unreachable while continuing to use the context. The normal Document#xpath, #css, and related search methods are not affected, and it is not triggerable by malicious document input. This vulnerability is fixed in 1.19.4.

oracle CPUOct2026: MySQL Cluster >=9.7.0|<=9.7.4

oracle CPUOct2026: MySQL Cluster >=8.0.0|<=8.0.38

oracle CPUOct2026: MySQL Cluster >=8.4.0|<=8.4.13

oracle CPUOct2026: MySQL Cluster >=8.0.0|<=8.0.50

oracle CPUOct2026: MySQL Cluster >=26.7.0|<=26.7.2

oracle CPUOct2026: MySQL Server >=8.4.0|<=8.4.13

oracle CPUOct2026: MySQL Server >=9.7.0|<=9.7.4

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4,
    calling Document#encoding= with an invalid encoding (e.g., a non-string, or a string containing a null
    byte) raises an exception, but only after freeing the document's current encoding string without replacing
    it. The document is left referencing freed memory, so the next call to Document#encoding reads invalid
    memory, which can cause a segfault or leak freed bytes into a Ruby String. Affects the CRuby (libxml2)
    implementation only; JRuby is not affected. This vulnerability is fixed in 1.19.4. (CVE-2026-57236)

  - Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the
    NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was
    not correctly enforced on the JRuby implementation. As a result, a schema parsed with default options
    could still cause external resources to be fetched over the network, potentially enabling SSRF or XXE
    attacks. This vulnerability is fixed in 1.19.4. (CVE-2026-57234)

  - Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4,
    Nokogiri::XML::NodeSet#[] (and its alias #slice) checked the requested index against the node set's bounds
    using a 32-bit-truncated copy of the index. A large negative index could pass the check and then be used
    at full width, reading outside the node set's storage. On CRuby this is an out-of-bounds read that
    typically crashes the process; on JRuby it is not memory-unsafe but returns an incorrect node. This
    vulnerability is fixed in 1.19.4. (CVE-2026-57235)

  - Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4,
    Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes
    that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could crash the
    process. This vulnerability is fixed in 1.19.4. (CVE-2026-57434)

An update of the rubygem package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4,     Nokogiri::XML::XPathContext did not keep its source document alive for garbage collection. If an     XPathContext outlived its document and the document was collected, evaluating an XPath expression could     read invalid memory and potentially segfault. This is only reachable when application code constructs an     XPathContext directly and lets the document become unreachable while continuing to use the context. The     normal Document#xpath, #css, and related search methods are not affected, and it is not triggerable by     malicious document input. This vulnerability is fixed in 1.19.4. (CVE-2026-57437)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
478655	Alpine: ruby-nokogiri: security update to 1.19.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	medium
478655	Alpine: ruby-nokogiri: security update to 1.19.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	medium
332554	Photon OS 5.0: Rubygem PHSA-2026-5.0-91-0911	Nessus	PhotonOS Local Security Checks	Local	medium
325379	Photon OS 4.0: Rubygem PHSA-2026-4.0-1051	Nessus	PhotonOS Local Security Checks	Local	medium
324558	Photon OS 5.0: Rubygem PHSA-2026-5.0-0911	Nessus	PhotonOS Local Security Checks	Local	medium
323620	Linux Distros Unpatched Vulnerability : CVE-2026-57437	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-57437

medium

Tenable Plugins

Coming Soon

medium

medium

medium

medium

medium

medium