CVE-2026-57435: Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri’s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, Nokogiri::XML::Attr#value= could free the underlying native child node while the wrapper remained reachable through the document node cache. A later use of the freed child node or a Ruby GC mark could dereference an invalid pointer, causing an invalid read and a possible segfault. This vulnerability is fixed in 1.19.4.
Other sources
Nokogiri: Possible Use-After-Free when setting an attribute value via Nokogiri::XML::Attr#value= or #content=
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.19.4-1 - Upgrade
Upgrade
Nokogirito a version that resolves this vulnerability.Fixed in 1.19.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57435?
The severity of CVE-2026-57435 is rated at 18, indicating a critical risk.
How do I fix CVE-2026-57435?
To fix CVE-2026-57435, upgrade Nokogiri to version 1.19.4 or later.
What does CVE-2026-57435 involve?
CVE-2026-57435 involves a possible use-after-free vulnerability in Nokogiri when setting an attribute value.
Who is affected by CVE-2026-57435?
Users of Nokogiri versions prior to 1.19.4 are affected by CVE-2026-57435.
What types of applications are impacted by CVE-2026-57435?
Applications that depend on Nokogiri for parsing XML or HTML are impacted by CVE-2026-57435.