CVE-2026-79771

Description

Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes.

References

https://www.vulncheck.com/advisories/nokogiri-before-memory-leak-via-xslt-transform

https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v2fc-qm4h-8hqv

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4

EPSS