{"id":"CVE-2026-57436","aliases":["ALPINE-CVE-2026-57436","AZL-91077","BELL-CVE-2026-57436","DEBIAN-CVE-2026-57436","EUVD-2026-39427","GHSA-wjv4-x9w8-wm3h","UBUNTU-CVE-2026-57436"],"status":"published","title":"Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type","description":"Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::Document#root= validated only that the new root was a Nokogiri::XML::Node, allowing a DTD node to be set as the document root. The result is a heap use-after-free during garbage collection or finalization, leading to an invalid memory read or potentially a segfault. This vulnerability is fixed in 1.19.4.","severity":{"version":"4.0","score":1.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00402,"percentile":0.34915,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2026-06-19T16:36:59Z","modified":"2026-11-08T16:30:02Z","fixes":[{"ecosystem":"RubyGems","package":"nokogiri","fixed_in":["1.19.4"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.24","package":"ruby-nokogiri","fixed_in":["1.19.4-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"rubygem-nokogiri","fixed_in":["1.19.4-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"ruby-nokogiri","fixed_in":["1.19.4-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-nokogiri","fixed_in":["1.19.4+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.4-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.4-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.9-r1"},{"fixed":"1.19.4-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.10+dfsg-2","1.14.2+dfsg-1","1.14.3+dfsg-1","1.14.3+dfsg-2","1.15.4+dfsg-1","1.16.0+dfsg-1","1.16.0+dfsg-2","1.16.2+dfsg-1","1.16.4+dfsg-1","1.17.2+dfsg-1~exp1","1.18.10+dfsg-1","1.18.10+dfsg-2","1.18.10+dfsg-3","1.18.2+dfsg-1","1.19.1+dfsg-1","1.19.3+dfsg-1","1.19.4+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.10+dfsg-1","1.18.10+dfsg-2","1.18.10+dfsg-3","1.18.2+dfsg-1","1.19.1+dfsg-1","1.19.3+dfsg-1","1.19.4+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.4+dfsg-1"}]}],"versions":["1.18.10+dfsg-1","1.18.10+dfsg-2","1.18.10+dfsg-3","1.18.2+dfsg-1","1.19.1+dfsg-1","1.19.3+dfsg-1"]},{"source":"osv","ecosystem":"RubyGems","package":"nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.4"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.1.0","1.1.1","1.10.0","1.10.0.rc1","1.10.1","1.10.10","1.10.2","1.10.3","1.10.4","1.10.5","1.10.6","1.10.7","1.10.8","1.10.9","1.11.0","1.11.0.rc1","1.11.0.rc2","1.11.0.rc3","1.11.0.rc4","1.11.1","1.11.2","1.11.3","1.11.4","1.11.5","1.11.6","1.11.7","1.12.0","1.12.0.rc1","1.12.1","1.12.2","1.12.3","1.12.4","1.12.5","1.13.0","1.13.1","1.13.10","1.13.2","1.13.3","1.13.4","1.13.5","1.13.6","1.13.7","1.13.8","1.13.9","1.14.0","1.14.0.rc1","1.14.1","1.14.2","1.14.3","1.14.4","1.14.5","1.15.0","1.15.1","1.15.2","1.15.3","1.15.4","1.15.5","1.15.6","1.15.7","1.16.0","1.16.0.rc1","1.16.1","1.16.2","1.16.3","1.16.4","1.16.5","1.16.6","1.16.7","1.16.8","1.17.0","1.17.1","1.17.2","1.18.0","1.18.0.rc1","1.18.1","1.18.10","1.18.2","1.18.3","1.18.4","1.18.5","1.18.6","1.18.7","1.18.8","1.18.9","1.19.0","1.19.1","1.19.2","1.19.3","1.2.0","1.2.1","1.2.2","1.2.3","1.3.0","1.3.1","1.3.2","1.3.3","1.4.0","1.4.1","1.4.2","1.4.2.1","1.4.3","1.4.3.1","1.4.4","1.4.4.1","1.4.4.2","1.4.5","1.4.6","1.4.7","1.5.0","1.5.0.beta.1","1.5.0.beta.2","1.5.0.beta.3","1.5.0.beta.4","1.5.1","1.5.1.rc1","1.5.10","1.5.11","1.5.2","1.5.3","1.5.3.rc2","1.5.3.rc3","1.5.3.rc4","1.5.3.rc5","1.5.3.rc6","1.5.4","1.5.4.rc1","1.5.4.rc2","1.5.4.rc3","1.5.5","1.5.5.rc1","1.5.5.rc2","1.5.5.rc3","1.5.6","1.5.6.rc1","1.5.6.rc2","1.5.6.rc3","1.5.7","1.5.7.rc1","1.5.7.rc2","1.5.7.rc3","1.5.8","1.5.9","1.6.0","1.6.0.rc1","1.6.1","1.6.2","1.6.2.1","1.6.2.rc1","1.6.2.rc2","1.6.2.rc3","1.6.3","1.6.3.1","1.6.3.rc1","1.6.3.rc2","1.6.3.rc3","1.6.4","1.6.4.1","1.6.5","1.6.6.1","1.6.6.2","1.6.6.3","1.6.6.4","1.6.7","1.6.7.1","1.6.7.2","1.6.7.rc2","1.6.7.rc3","1.6.7.rc4","1.6.8","1.6.8.1","1.6.8.rc1","1.6.8.rc2","1.6.8.rc3","1.7.0","1.7.0.1","1.7.1","1.7.2","1.8.0","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.9.0","1.9.0.rc1","1.9.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.9-2","1.5.9-3","1.6.0-1","1.6.1+ds-1","1.6.1+ds-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.6.2+ds-2build2","1.6.6.3-1","1.6.7-1","1.6.7.1-1","1.6.7.2-3","1.6.7.2-3build1","1.6.7.2-3ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.0-1","1.8.1-1","1.8.1-1build1","1.8.2-1build1","1.8.2-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.3+dfsg1-2","1.10.4+dfsg1-1","1.10.7+dfsg1-1","1.10.7+dfsg1-2","1.10.7+dfsg1-2build1","1.10.7+dfsg1-2ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.1+dfsg-2ubuntu1","1.11.7+dfsg-3","1.11.7+dfsg-3build1","1.13.1+dfsg-2","1.13.1+dfsg-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14.3+dfsg-2","1.16.2+dfsg-1","1.16.2+dfsg-1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.4+dfsg-1build1","1.18.2+dfsg-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.10+dfsg-3","1.19.1+dfsg-1","1.19.3+dfsg-1","1.19.4+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ruby-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.2+dfsg-1build1","1.18.10+dfsg-2","1.18.10+dfsg-3"]}],"products":[{"vendor":"nokogiri","product":"nokogiri"},{"vendor":"sparklemotion","product":"nokogiri"}],"references":[{"url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-wjv4-x9w8-wm3h","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/advisories/GHSA-wjv4-x9w8-wm3h"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-57436","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57436","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-57436","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57436.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-57436","tags":["advisory"]},{"url":"https://github.com/sparklemotion/nokogiri","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-57436","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-57436","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-57436","title":"Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type","description":"Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::Document#root= validated only that the new root was a Nokogiri::XML::Node, allowing a DTD node to be set as the document root. The result is a heap use-after-free during garbage collection or finalization, leading to an invalid memory read or potentially a segfault. This vulnerability is fixed in 1.19.4.","status":"published","published":"2026-06-25T14:33:29.496Z","modified":"2026-06-25T23:27:34.41Z","cvss":[{"version":"4.0","score":1.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","level":"low","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T13:43:56.024247Z"}],"euvd":[{"id":"EUVD-2026-39427","description":"Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::Document#root= validated only that the new root was a Nokogiri::XML::Node, allowing a DTD node to be set as the document root. The result is a heap use-after-free during garbage collection or finalization, leading to an invalid memory read or potentially a segfault. This vulnerability is fixed in 1.19.4.","status":"published","published":"2026-06-25T14:33:29Z","modified":"2026-06-25T23:27:34Z","cvss":[{"version":"4.0","score":1.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","level":"low"}],"updated_at":"2026-11-02T18:20:25.316004Z"}],"ghsa":[{"id":"GHSA-wjv4-x9w8-wm3h","title":"Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type","description":"### Summary\n\n`Nokogiri::XML::Document#root=` validated only that the new root was a `Nokogiri::XML::Node`, allowing a DTD node to be set as the document root. The result is a heap use-after-free during garbage collection or finalization, leading to an invalid memory read or potentially a segfault.\n\nNokogiri 1.19.4 restricts `Document#root=` to element nodes, raising `TypeError` for any other node type.\n\nThis memory-safety issue affects only the CRuby implementation (libxml2). The JRuby implementation was not affected; the same input validation was added there for behavioral parity.\n\n### Severity\n\nThe Nokogiri maintainers have evaluated this as low severity. This is only triggered by a programming error. It requires application code to assign a non-element node such as a DTD as the document root via `Document#root=`. Nokogiri 1.19.4 now raises `TypeError` instead of allowing a use-after-free. It cannot be triggered by untrusted input or through normal use of the public API.\n\n### Mitigation\n\nUpgrade to Nokogiri 1.19.4 or later.\n\nAs a workaround, applications that cannot upgrade should avoid assigning a DTD (or any non-element node) via `Document#root=`.\n\n### Credit\n\nThis issue was responsibly reported by Zheng Yu from depthfirst.com.","status":"published","published":"2026-06-19T16:36:59Z","modified":"2026-07-30T20:30:14Z","cvss":[{"version":"4.0","score":1.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:40:54.767849Z"}],"nvd":[{"id":"CVE-2026-57436","description":"Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::Document#root= validated only that the new root was a Nokogiri::XML::Node, allowing a DTD node to be set as the document root. The result is a heap use-after-free during garbage collection or finalization, leading to an invalid memory read or potentially a segfault. This vulnerability is fixed in 1.19.4.","status":"published","published":"2026-06-25T15:16:41.163Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"4.0","score":1.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:12:26.045561Z"}],"osv":[{"id":"ALPINE-CVE-2026-57436","description":"Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::Document#root= validated only that the new root was a Nokogiri::XML::Node, allowing a DTD node to be set as the document root. The result is a heap use-after-free during garbage collection or finalization, leading to an invalid memory read or potentially a segfault. This vulnerability is fixed in 1.19.4.","status":"published","published":"2026-06-25T15:16:41.163Z","modified":"2026-11-08T16:30:02.984944842Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-08T16:37:21.591054Z"},{"id":"BELL-CVE-2026-57436","status":"published","published":"2026-06-27T06:13:06.576712Z","modified":"2026-07-14T07:15:06.229405958Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"CVE-2026-57436","title":"Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type","description":"Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::Document#root= validated only that the new root was a Nokogiri::XML::Node, allowing a DTD node to be set as the document root. The result is a heap use-after-free during garbage collection or finalization, leading to an invalid memory read or potentially a segfault. This vulnerability is fixed in 1.19.4.","status":"published","published":"2026-06-25T14:33:29.496Z","modified":"2026-10-28T02:30:29.160608541Z","cvss":[{"version":"4.0","score":1.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:45:12.016252Z"},{"id":"DEBIAN-CVE-2026-57436","description":"Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::Document#root= validated only that the new root was a Nokogiri::XML::Node, allowing a DTD node to be set as the document root. The result is a heap use-after-free during garbage collection or finalization, leading to an invalid memory read or potentially a segfault. This vulnerability is fixed in 1.19.4.","status":"published","published":"2026-06-25T15:16:41.163Z","modified":"2026-10-26T11:47:27.774509535Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"GHSA-wjv4-x9w8-wm3h","title":"Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type","description":"### Summary\n\n`Nokogiri::XML::Document#root=` validated only that the new root was a `Nokogiri::XML::Node`, allowing a DTD node to be set as the document root. The result is a heap use-after-free during garbage collection or finalization, leading to an invalid memory read or potentially a segfault.\n\nNokogiri 1.19.4 restricts `Document#root=` to element nodes, raising `TypeError` for any other node type.\n\nThis memory-safety issue affects only the CRuby implementation (libxml2). The JRuby implementation was not affected; the same input validation was added there for behavioral parity.\n\n### Severity\n\nThe Nokogiri maintainers have evaluated this as low severity. This is only triggered by a programming error. It requires application code to assign a non-element node such as a DTD as the document root via `Document#root=`. Nokogiri 1.19.4 now raises `TypeError` instead of allowing a use-after-free. It cannot be triggered by untrusted input or through normal use of the public API.\n\n### Mitigation\n\nUpgrade to Nokogiri 1.19.4 or later.\n\nAs a workaround, applications that cannot upgrade should avoid assigning a DTD (or any non-element node) via `Document#root=`.\n\n### Credit\n\nThis issue was responsibly reported by Zheng Yu from depthfirst.com.","status":"published","published":"2026-06-19T16:36:59Z","modified":"2026-09-10T03:50:50.907992171Z","cvss":[{"version":"4.0","score":1.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:46:58.767335Z"},{"id":"UBUNTU-CVE-2026-57436","description":"Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::Document#root= validated only that the new root was a Nokogiri::XML::Node, allowing a DTD node to be set as the document root. The result is a heap use-after-free during garbage collection or finalization, leading to an invalid memory read or potentially a segfault. This vulnerability is fixed in 1.19.4.","status":"published","published":"2026-06-25T15:16:00Z","modified":"2026-10-17T12:59:12.765960615Z","cvss":[{"version":"4.0","score":1.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","level":"low"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"AZL-91077","title":"CVE-2026-57436 affecting package rubygem-nokogiri for versions less than 1.19.4-1","description":"Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::Document#root= validated only that the new root was a Nokogiri::XML::Node, allowing a DTD node to be set as the document root. The result is a heap use-after-free during garbage collection or finalization, leading to an invalid memory read or potentially a segfault. This vulnerability is fixed in 1.19.4.","status":"published","published":"2026-06-25T15:16:41Z","modified":"2026-08-28T17:57:01.833926Z","updated_at":"2026-11-02T15:28:11.397546Z"}]}}