CVE-2026-126064
Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Node#[]=` or `#lang=`
CVE-2026-126064 is a low vulnerability (CVSS 2.0) in Sparklemotion Nokogiri, published November 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 4th percentile. Fixed in nokogiri 1.19.5.
- Severity
- 2.0 LowCVSS 4.0, CVE List
- Exploit chance
- 0.15%EPSS, 4th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.19.5nokogiri +13 more
Description
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, the CRuby native extension can leave Ruby wrappers pointing to freed memory when Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang= replaces an existing attribute value after code has accessed the attribute's child nodes. Replacing the value frees native child nodes while their wrappers remain reachable, and later use of those wrappers can cause an invalid read or process segfault. JRuby is not affected. This issue is fixed in version 1.19.5.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nokogiriRubyGems | before 1.19.5 | 1.19.5 |
rubygem-nokogiriAzure Linux:3 | through 1.19.4-1 | None known |
ruby-nokogiriDebian:12 | All versions, plus listed versions 1.13.10+dfsg-21.14.2+dfsg-11.14.3+dfsg-11.14.3+dfsg-21.15.4+dfsg-1 Show 13 moreShow less1.16.0+dfsg-11.16.0+dfsg-21.16.2+dfsg-11.16.4+dfsg-11.17.2+dfsg-1~exp11.18.10+dfsg-11.18.10+dfsg-21.18.10+dfsg-31.18.2+dfsg-11.19.1+dfsg-11.19.3+dfsg-11.19.4+dfsg-11.19.7+dfsg-1 | None known |
ruby-nokogiriDebian:13 | All versions, plus listed versions 1.18.10+dfsg-11.18.10+dfsg-21.18.10+dfsg-31.18.2+dfsg-11.19.1+dfsg-11.19.3+dfsg-11.19.4+dfsg-11.19.7+dfsg-1 | None known |
ruby-nokogiriDebian:14 | All versions, plus listed versions 1.18.10+dfsg-11.18.10+dfsg-21.18.10+dfsg-31.18.2+dfsg-11.19.1+dfsg-11.19.3+dfsg-11.19.4+dfsg-11.19.7+dfsg-1 | None known |
nokogiriRubyGems | before 1.19.5, plus listed versions 1.0.01.0.11.0.21.0.31.0.4 Show 45 moreShow less1.0.51.0.61.0.71.1.01.1.11.10.01.10.0.rc11.10.11.10.101.10.21.10.31.10.41.10.51.10.61.10.71.10.81.10.91.11.01.11.0.rc11.11.0.rc21.11.0.rc31.11.0.rc41.11.11.11.21.11.31.11.41.11.51.11.61.11.71.12.01.12.0.rc11.12.11.12.21.12.31.12.41.12.51.13.01.13.11.13.101.13.21.13.31.13.41.13.51.13.61.13.7 | 1.19.5 |
ruby-nokogiriUbuntu:Pro:14.04:LTS | All versions, plus listed versions 1.5.9-21.5.9-31.6.0-11.6.1+ds-11.6.1+ds-1ubuntu0.1~esm1 | None known |
ruby-nokogiriUbuntu:16.04:LTS | All versions, plus listed versions 1.6.6.2+ds-2build21.6.6.3-11.6.7-11.6.7.1-11.6.7.2-31.6.7.2-3build11.6.7.2-3ubuntu0.1 | None known |
ruby-nokogiriUbuntu:18.04:LTS | All versions, plus listed versions 1.8.0-11.8.1-11.8.1-1build11.8.2-1build11.8.2-1ubuntu0.1 | None known |
ruby-nokogiriUbuntu:Pro:20.04:LTS | All versions, plus listed versions 1.10.3+dfsg1-21.10.4+dfsg1-11.10.7+dfsg1-11.10.7+dfsg1-21.10.7+dfsg1-2build11.10.7+dfsg1-2ubuntu0.1~esm2 | None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ruby-nokogiriUbuntu:Pro:22.04:LTS | All versions, plus listed versions 1.11.1+dfsg-2ubuntu11.11.7+dfsg-31.11.7+dfsg-3build11.13.1+dfsg-21.13.1+dfsg-2ubuntu0.1~esm1 | None known |
ruby-nokogiriUbuntu:24.04:LTS | All versions, plus listed versions 1.14.3+dfsg-21.16.2+dfsg-11.16.2+dfsg-1build1 | None known |
ruby-nokogiriUbuntu:26.10 | All versions, plus listed versions 1.18.10+dfsg-31.19.1+dfsg-11.19.3+dfsg-11.19.4+dfsg-1 | None known |
ruby-nokogiriUbuntu:26.04:LTS | All versions, plus listed versions 1.18.2+dfsg-1build11.18.10+dfsg-21.18.10+dfsg-3 | None known |
What each source reports
CVE List Score used
Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Node#[]=` or `#lang=`
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, the CRuby native extension can leave Ruby wrappers pointing to freed memory when Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang= replaces an existing attribute value after code has accessed the attribute's child nodes. Replacing the value frees native child nodes while their wrappers remain reachable, and later use of those wrappers can cause an invalid read or process segfault. JRuby is not affected. This issue is fixed in version 1.19.5.
- Record
CVE-2026-126064- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-416
- Updated
- 2026-11-10
EUVDEUVD-2026-122836
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, the CRuby native extension can leave Ruby wrappers pointing to freed memory when Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang= replaces an existing attribute value after code has accessed the attribute's child nodes. Replacing the value frees native child nodes while their wrappers remain reachable, and later use of those wrappers can cause an invalid read or process segfault. JRuby is not affected. This issue is fixed in version 1.19.5.
- Record
EUVD-2026-122836- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-10
GitHub AdvisoriesGHSA-3w22-6jfg-527w
Nokogiri: Use-After-Free in Nokogiri when replacing an attribute value
Summary
Nokogiri's CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an existing XML attribute via Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang=. If Ruby code had already accessed the attribute's child nodes, replacing the value could free those native child nodes while their wrappers remained reachable. Using one of those child nodes afterwards could cause an invalid read and a possible segfault.
This is the same class of issue as GHSA-phwj-rprq-35pp, which was fixed for Attr#value= in Nokogiri 1.19.4.
Nokogiri 1.19.5 preserves all already-wrapped attribute child nodes before replacing the attribute value.
JRuby is not affected.
Severity
The Nokogiri maintainers have evaluated this as low severity. Reaching it requires an unusual API-usage pattern that does not arise during normal use. The application must directly access an attribute's child nodes and then replace that same attribute's value via Node#[]= or Node#lang=. Nokogiri 1.19.5 makes this pattern safe with no change to the public API.
Mitigation
Upgrade to Nokogiri 1.19.5 or later.
As a workaround, avoid accessing attribute child nodes directly via Attr#children or similar before replacing the same attribute's value.
Credit
This issue was responsibly reported by zx (@manus-pi).
- Record
GHSA-3w22-6jfg-527w- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-416
- Updated
- 2026-11-10
NVD
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, the CRuby native extension can leave Ruby wrappers pointing to freed memory when Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang= replaces an existing attribute value after code has accessed the attribute's child nodes. Replacing the value frees native child nodes while their wrappers remain reachable, and later use of those wrappers can cause an invalid read or process segfault. JRuby is not affected. This issue is fixed in version 1.19.5.
- Record
CVE-2026-126064- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-416
- Updated
- 2026-11-11
OSV
Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Node#[]=` or `#lang=`
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, the CRuby native extension can leave Ruby wrappers pointing to freed memory when Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang= replaces an existing attribute value after code has accessed the attribute's child nodes. Replacing the value frees native child nodes while their wrappers remain reachable, and later use of those wrappers can cause an invalid read or process segfault. JRuby is not affected. This issue is fixed in version 1.19.5.
- Record
CVE-2026-126064- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-416
- Updated
- 2026-11-12
OSVDEBIAN-CVE-2026-126064
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, the CRuby native extension can leave Ruby wrappers pointing to freed memory when Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang= replaces an existing attribute value after code has accessed the attribute's child nodes. Replacing the value frees native child nodes while their wrappers remain reachable, and later use of those wrappers can cause an invalid read or process segfault. JRuby is not affected. This issue is fixed in version 1.19.5.
- Record
DEBIAN-CVE-2026-126064- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-11
OSVGHSA-3w22-6jfg-527w
Nokogiri: Use-After-Free in Nokogiri when replacing an attribute value
Summary
Nokogiri's CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an existing XML attribute via Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang=. If Ruby code had already accessed the attribute's child nodes, replacing the value could free those native child nodes while their wrappers remained reachable. Using one of those child nodes afterwards could cause an invalid read and a possible segfault.
This is the same class of issue as GHSA-phwj-rprq-35pp, which was fixed for Attr#value= in Nokogiri 1.19.4.
Nokogiri 1.19.5 preserves all already-wrapped attribute child nodes before replacing the attribute value.
JRuby is not affected.
Severity
The Nokogiri maintainers have evaluated this as low severity. Reaching it requires an unusual API-usage pattern that does not arise during normal use. The application must directly access an attribute's child nodes and then replace that same attribute's value via Node#[]= or Node#lang=. Nokogiri 1.19.5 makes this pattern safe with no change to the public API.
Mitigation
Upgrade to Nokogiri 1.19.5 or later.
As a workaround, avoid accessing attribute child nodes directly via Attr#children or similar before replacing the same attribute's value.
Credit
This issue was responsibly reported by zx (@manus-pi).
- Record
GHSA-3w22-6jfg-527w- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-416
- Updated
- 2026-11-10
OSVUBUNTU-CVE-2026-126064
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, the CRuby native extension can leave Ruby wrappers pointing to freed memory when Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang= replaces an existing attribute value after code has accessed the attribute's child nodes. Replacing the value frees native child nodes while their wrappers remain reachable, and later use of those wrappers can cause an invalid read or process segfault. JRuby is not affected. This issue is fixed in version 1.19.5.
- Record
UBUNTU-CVE-2026-126064- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-13
OSVAZL-113338No score
CVE-2026-126064 affecting package rubygem-nokogiri 1.19.4-1
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, the CRuby native extension can leave Ruby wrappers pointing to freed memory when Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang= replaces an existing attribute value after code has accessed the attribute's child nodes. Replacing the value frees native child nodes while their wrappers remain reachable, and later use of those wrappers can cause an invalid read or process segfault. JRuby is not affected. This issue is fixed in version 1.19.5.
- Record
AZL-113338- Updated
- 2026-11-11
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| affected, aliases, references | NVD, OSV | |
| published | EUVD | |
| published | EUVD | |
| description, references, severity, title | CVE List | |
| aliases, products, published, references | EUVD | |
| affected, references | OSV | |
| first indexed | GitHub Advisories |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/sparklemotion/nokogiri/security/advisories/GHSA-3w22-6jfg-527w
Show 7 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-126064
security-tracker.debian.org/tracker/CVE-2026-126064
ubuntu.com/security/CVE-2026-126064
cve.org/CVERecord?id=CVE-2026-126064
Left out here: 145 versions. The JSON record has them.