CVE-2026-57434: Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could crash the process. This vulnerability is fixed in 1.19.4.
Other sources
Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.19.4-1 - Upgrade
Upgrade
nokogirito a version that resolves this vulnerability.Fixed in 1.19.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57434?
CVE-2026-57434 has a risk score of 17, indicating a significant security flaw.
How do I fix CVE-2026-57434?
To fix CVE-2026-57434, update Nokogiri to version 1.19.4 or later.
What impact does CVE-2026-57434 have?
CVE-2026-57434 can lead to application crashes due to a NULL pointer dereference.
Which versions of Nokogiri are affected by CVE-2026-57434?
Nokogiri versions prior to 1.19.4 are affected by CVE-2026-57434.
Is CVE-2026-57434 related to other security issues?
CVE-2026-57434 is specifically a null pointer dereference vulnerability and should be addressed independently.