Every CVE Search/ Get API key

CVE-2026-57435

Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`

1.7 LowFix available

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri’s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, Nokogiri::XML::Attr#value= could free the underlying native child node while the wrapper remained reachable through the document node cache. A later use of the freed child node or a Ruby GC mark could dereference an invalid pointer, causing an invalid read and a possible segfault. This vulnerability is fixed in 1.19.4.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.46%Up 0.1 points since Jun 26, 2026
90%50%10%1%

What each source reports

CVE List Score used 1.7

Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri’s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, Nokogiri::XML::Attr#value= could free the underlying native child node while the wrapper remained reachable through the document node cache. A later use of the freed child node or a Ruby GC mark could dereference an invalid pointer, causing an invalid read and a possible segfault. This vulnerability is fixed in 1.19.4.

Record
CVE-2026-57435
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
Weakness
CWE-416, CWE-825
Updated
2026-11-02
EUVDEUVD-2026-39426 1.7

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri’s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, Nokogiri::XML::Attr#value= could free the underlying native child node while the wrapper remained reachable through the document node cache. A later use of the freed child node or a Ruby GC mark could dereference an invalid pointer, causing an invalid read and a possible segfault. This vulnerability is fixed in 1.19.4.

Record
EUVD-2026-39426
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
Updated
2026-11-02
GitHub AdvisoriesGHSA-phwj-rprq-35pp 1.7

Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`

Summary

Nokogiri’s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, Nokogiri::XML::Attr#value= could free the underlying native child node while the wrapper remained reachable through the document node cache. A later use of the freed child node or a Ruby GC mark could dereference an invalid pointer, causing an invalid read and a possible segfault.

Nokogiri 1.19.4 preserves any already-wrapped attribute child nodes before replacing the attribute value.

JRuby is not affected.

Severity

The Nokogiri maintainers have evaluated this as low severity. Reaching it requires an unusual API-usage pattern that does not arise during normal use. The application must directly access an attribute's child node and then replace that same attribute's value via Attr#value= or #content=. Nokogiri 1.19.4 makes this pattern safe with no change to the public API. Already-wrapped attribute child nodes are preserved before the value is replaced.

Mitigation

Upgrade to Nokogiri 1.19.4 or later.

As a workaround, avoid accessing attribute child nodes directly via Attr#child or similar before mutating the same attribute’s value.

Credit

This issue was responsibly reported by Zheng Yu from depthfirst.com.

Record
GHSA-phwj-rprq-35pp
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
Weakness
CWE-416, CWE-825
Updated
2026-11-02
NVD 1.7

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri’s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, Nokogiri::XML::Attr#value= could free the underlying native child node while the wrapper remained reachable through the document node cache. A later use of the freed child node or a Ruby GC mark could dereference an invalid pointer, causing an invalid read and a possible segfault. This vulnerability is fixed in 1.19.4.

Record
CVE-2026-57435
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-416, CWE-825
Updated
2026-11-02
OSVBELL-CVE-2026-57435 7.5
Record
BELL-CVE-2026-57435
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 1.7

Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri’s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, Nokogiri::XML::Attr#value= could free the underlying native child node while the wrapper remained reachable through the document node cache. A later use of the freed child node or a Ruby GC mark could dereference an invalid pointer, causing an invalid read and a possible segfault. This vulnerability is fixed in 1.19.4.

Record
CVE-2026-57435
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
Weakness
CWE-416, CWE-825
Updated
2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2026-57435 7.5

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri’s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, Nokogiri::XML::Attr#value= could free the underlying native child node while the wrapper remained reachable through the document node cache. A later use of the freed child node or a Ruby GC mark could dereference an invalid pointer, causing an invalid read and a possible segfault. This vulnerability is fixed in 1.19.4.

Record
DEBIAN-CVE-2026-57435
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGHSA-phwj-rprq-35pp 1.7

Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`

Summary

Nokogiri’s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, Nokogiri::XML::Attr#value= could free the underlying native child node while the wrapper remained reachable through the document node cache. A later use of the freed child node or a Ruby GC mark could dereference an invalid pointer, causing an invalid read and a possible segfault.

Nokogiri 1.19.4 preserves any already-wrapped attribute child nodes before replacing the attribute value.

JRuby is not affected.

Severity

The Nokogiri maintainers have evaluated this as low severity. Reaching it requires an unusual API-usage pattern that does not arise during normal use. The application must directly access an attribute's child node and then replace that same attribute's value via Attr#value= or #content=. Nokogiri 1.19.4 makes this pattern safe with no change to the public API. Already-wrapped attribute child nodes are preserved before the value is replaced.

Mitigation

Upgrade to Nokogiri 1.19.4 or later.

As a workaround, avoid accessing attribute child nodes directly via Attr#child or similar before mutating the same attribute’s value.

Credit

This issue was responsibly reported by Zheng Yu from depthfirst.com.

Record
GHSA-phwj-rprq-35pp
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
Weakness
CWE-416, CWE-825
Updated
2026-11-02
OSVUBUNTU-CVE-2026-57435 1.7

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri’s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, Nokogiri::XML::Attr#value= could free the underlying native child node while the wrapper remained reachable through the document node cache. A later use of the freed child node or a Ruby GC mark could dereference an invalid pointer, causing an invalid read and a possible segfault. This vulnerability is fixed in 1.19.4.

Record
UBUNTU-CVE-2026-57435
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-91065 No score

CVE-2026-57435 affecting package rubygem-nokogiri for versions less than 1.19.4-1

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri’s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, Nokogiri::XML::Attr#value= could free the underlying native child node while the wrapper remained reachable through the document node cache. A later use of the freed child node or a Ruby GC mark could dereference an invalid pointer, causing an invalid read and a possible segfault. This vulnerability is fixed in 1.19.4.

Record
AZL-91065
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nokogiri
RubyGems
 before 1.19.4
1.19.4
rubygem-nokogiri
Azure Linux:3
 before 1.19.4-1
1.19.4-1
ruby-nokogiri
Alpaquita:stream
 1.13.9-r1 up to 1.19.4-r0
1.19.4-r0
ruby-nokogiri
Debian:12
 All versions, plus listed versions
1.13.10+dfsg-21.14.2+dfsg-11.14.3+dfsg-11.14.3+dfsg-21.15.4+dfsg-1
Show 12 moreShow less
1.16.0+dfsg-11.16.0+dfsg-21.16.2+dfsg-11.16.4+dfsg-11.17.2+dfsg-1~exp11.18.10+dfsg-11.18.10+dfsg-21.18.10+dfsg-31.18.2+dfsg-11.19.1+dfsg-11.19.3+dfsg-11.19.4+dfsg-1
 None known
ruby-nokogiri
Debian:13
 All versions, plus listed versions
1.18.10+dfsg-11.18.10+dfsg-21.18.10+dfsg-31.18.2+dfsg-11.19.1+dfsg-11.19.3+dfsg-11.19.4+dfsg-1
 None known
ruby-nokogiri
Debian:14
 before 1.19.4+dfsg-1, plus listed versions
1.18.10+dfsg-11.18.10+dfsg-21.18.10+dfsg-31.18.2+dfsg-11.19.1+dfsg-11.19.3+dfsg-1
1.19.4+dfsg-1
nokogiri
RubyGems
 before 1.19.4, plus listed versions
1.0.01.0.11.0.21.0.31.0.4
Show 45 moreShow less
1.0.51.0.61.0.71.1.01.1.11.10.01.10.0.rc11.10.11.10.101.10.21.10.31.10.41.10.51.10.61.10.71.10.81.10.91.11.01.11.0.rc11.11.0.rc21.11.0.rc31.11.0.rc41.11.11.11.21.11.31.11.41.11.51.11.61.11.71.12.01.12.0.rc11.12.11.12.21.12.31.12.41.12.51.13.01.13.11.13.101.13.21.13.31.13.41.13.51.13.61.13.7
1.19.4
ruby-nokogiri
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.5.9-21.5.9-31.6.0-11.6.1+ds-11.6.1+ds-1ubuntu0.1~esm1
 None known
ruby-nokogiri
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.6.6.2+ds-2build21.6.6.3-11.6.7-11.6.7.1-11.6.7.2-31.6.7.2-3build11.6.7.2-3ubuntu0.1
 None known
ruby-nokogiri
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.8.0-11.8.1-11.8.1-1build11.8.2-1build11.8.2-1ubuntu0.1
 None known
Show 6 moreShow less
Affected packages
PackageAffectedFixed
ruby-nokogiri
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.10.3+dfsg1-21.10.4+dfsg1-11.10.7+dfsg1-11.10.7+dfsg1-21.10.7+dfsg1-2build11.10.7+dfsg1-2ubuntu0.1~esm2
 None known
ruby-nokogiri
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.11.1+dfsg-2ubuntu11.11.7+dfsg-31.11.7+dfsg-3build11.13.1+dfsg-21.13.1+dfsg-2ubuntu0.1~esm1
 None known
ruby-nokogiri
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.14.3+dfsg-21.16.2+dfsg-11.16.2+dfsg-1build1
 None known
ruby-nokogiri
Ubuntu:25.10
 All versions, plus listed versions
1.16.4+dfsg-1build11.18.2+dfsg-1build1
 None known
ruby-nokogiri
Ubuntu:26.10
 All versions, plus listed versions
1.18.10+dfsg-31.19.1+dfsg-11.19.3+dfsg-11.19.4+dfsg-1
 None known
ruby-nokogiri
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.18.2+dfsg-1build11.18.10+dfsg-21.18.10+dfsg-3
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-57435 is a low vulnerability (CVSS 1.7) in Nokogiri, published June 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in nokogiri 1.19.4.

References

This page doesn't list everything

Left out here: 144 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open