Every CVE Search/ Get API key

CVE-2026-57434

Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes

1.7 LowFix available

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could crash the process. This vulnerability is fixed in 1.19.4.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.46%Up 0.1 points since Jun 26, 2026
90%50%10%1%

What each source reports

CVE List Score used 1.7

Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could crash the process. This vulnerability is fixed in 1.19.4.

Record
CVE-2026-57434
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
Weakness
CWE-476
Updated
2026-11-02
EUVDEUVD-2026-39424 1.7

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could crash the process. This vulnerability is fixed in 1.19.4.

Record
EUVD-2026-39424
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
Updated
2026-11-02
GitHub AdvisoriesGHSA-9cv2-cfxc-v4v2 1.7

Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes

Summary

Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could crash the process.

Nokogiri 1.19.4 checks for missing native data pointers and raises a RuntimeError.

JRuby is not affected.

Severity

The Nokogiri maintainers have evaluated this as low severity. This is only triggered by a programming error. It requires application code to call .allocate directly on a native-backed class and then invoke methods on the resulting uninitialized object. It cannot be triggered by untrusted input or through normal use of the public API.

Mitigation

Upgrade to Nokogiri 1.19.4 or later.

Avoid calling .allocate directly on Nokogiri native-backed classes. Use the documented constructors and factory methods instead.

Credit

This issue was responsibly reported by Zheng Yu from depthfirst.com.

Record
GHSA-9cv2-cfxc-v4v2
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
Weakness
CWE-476
Updated
2026-11-02
NVD 1.7

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could crash the process. This vulnerability is fixed in 1.19.4.

Record
CVE-2026-57434
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSVBELL-CVE-2026-57434 7.5
Record
BELL-CVE-2026-57434
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 1.7

Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could crash the process. This vulnerability is fixed in 1.19.4.

Record
CVE-2026-57434
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
Weakness
CWE-476
Updated
2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2026-57434 7.5

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could crash the process. This vulnerability is fixed in 1.19.4.

Record
DEBIAN-CVE-2026-57434
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGHSA-9cv2-cfxc-v4v2 1.7

Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes

Summary

Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could crash the process.

Nokogiri 1.19.4 checks for missing native data pointers and raises a RuntimeError.

JRuby is not affected.

Severity

The Nokogiri maintainers have evaluated this as low severity. This is only triggered by a programming error. It requires application code to call .allocate directly on a native-backed class and then invoke methods on the resulting uninitialized object. It cannot be triggered by untrusted input or through normal use of the public API.

Mitigation

Upgrade to Nokogiri 1.19.4 or later.

Avoid calling .allocate directly on Nokogiri native-backed classes. Use the documented constructors and factory methods instead.

Credit

This issue was responsibly reported by Zheng Yu from depthfirst.com.

Record
GHSA-9cv2-cfxc-v4v2
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
Weakness
CWE-476
Updated
2026-11-02
OSVUBUNTU-CVE-2026-57434 1.7

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could crash the process. This vulnerability is fixed in 1.19.4.

Record
UBUNTU-CVE-2026-57434
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-91074 No score

CVE-2026-57434 affecting package rubygem-nokogiri for versions less than 1.19.4-1

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could crash the process. This vulnerability is fixed in 1.19.4.

Record
AZL-91074
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nokogiri
RubyGems
 before 1.19.4
1.19.4
rubygem-nokogiri
Azure Linux:3
 before 1.19.4-1
1.19.4-1
ruby-nokogiri
Alpaquita:stream
 1.13.9-r1 up to 1.19.4-r0
1.19.4-r0
ruby-nokogiri
Debian:12
 All versions, plus listed versions
1.13.10+dfsg-21.14.2+dfsg-11.14.3+dfsg-11.14.3+dfsg-21.15.4+dfsg-1
Show 12 moreShow less
1.16.0+dfsg-11.16.0+dfsg-21.16.2+dfsg-11.16.4+dfsg-11.17.2+dfsg-1~exp11.18.10+dfsg-11.18.10+dfsg-21.18.10+dfsg-31.18.2+dfsg-11.19.1+dfsg-11.19.3+dfsg-11.19.4+dfsg-1
 None known
ruby-nokogiri
Debian:13
 All versions, plus listed versions
1.18.10+dfsg-11.18.10+dfsg-21.18.10+dfsg-31.18.2+dfsg-11.19.1+dfsg-11.19.3+dfsg-11.19.4+dfsg-1
 None known
ruby-nokogiri
Debian:14
 before 1.19.4+dfsg-1, plus listed versions
1.18.10+dfsg-11.18.10+dfsg-21.18.10+dfsg-31.18.2+dfsg-11.19.1+dfsg-11.19.3+dfsg-1
1.19.4+dfsg-1
nokogiri
RubyGems
 before 1.19.4, plus listed versions
1.0.01.0.11.0.21.0.31.0.4
Show 45 moreShow less
1.0.51.0.61.0.71.1.01.1.11.10.01.10.0.rc11.10.11.10.101.10.21.10.31.10.41.10.51.10.61.10.71.10.81.10.91.11.01.11.0.rc11.11.0.rc21.11.0.rc31.11.0.rc41.11.11.11.21.11.31.11.41.11.51.11.61.11.71.12.01.12.0.rc11.12.11.12.21.12.31.12.41.12.51.13.01.13.11.13.101.13.21.13.31.13.41.13.51.13.61.13.7
1.19.4
ruby-nokogiri
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.5.9-21.5.9-31.6.0-11.6.1+ds-11.6.1+ds-1ubuntu0.1~esm1
 None known
ruby-nokogiri
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.6.6.2+ds-2build21.6.6.3-11.6.7-11.6.7.1-11.6.7.2-31.6.7.2-3build11.6.7.2-3ubuntu0.1
 None known
ruby-nokogiri
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.8.0-11.8.1-11.8.1-1build11.8.2-1build11.8.2-1ubuntu0.1
 None known
Show 6 moreShow less
Affected packages
PackageAffectedFixed
ruby-nokogiri
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.10.3+dfsg1-21.10.4+dfsg1-11.10.7+dfsg1-11.10.7+dfsg1-21.10.7+dfsg1-2build11.10.7+dfsg1-2ubuntu0.1~esm2
 None known
ruby-nokogiri
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.11.1+dfsg-2ubuntu11.11.7+dfsg-31.11.7+dfsg-3build11.13.1+dfsg-21.13.1+dfsg-2ubuntu0.1~esm1
 None known
ruby-nokogiri
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.14.3+dfsg-21.16.2+dfsg-11.16.2+dfsg-1build1
 None known
ruby-nokogiri
Ubuntu:25.10
 All versions, plus listed versions
1.16.4+dfsg-1build11.18.2+dfsg-1build1
 None known
ruby-nokogiri
Ubuntu:26.10
 All versions, plus listed versions
1.18.10+dfsg-31.19.1+dfsg-11.19.3+dfsg-11.19.4+dfsg-1
 None known
ruby-nokogiri
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.18.2+dfsg-1build11.18.10+dfsg-21.18.10+dfsg-3
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-57434 is a low vulnerability (CVSS 1.7) in Nokogiri, published June 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in nokogiri 1.19.4.

References

This page doesn't list everything

Left out here: 144 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open