CVE-2026-57437: Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::XPathContext did not keep its source document alive for garbage collection. If an XPathContext outlived its document and the document was collected, evaluating an XPath expression could read invalid memory and potentially segfault. This is only reachable when application code constructs an XPathContext directly and lets the document become unreachable while continuing to use the context. The normal Document#xpath, #css, and related search methods are not affected, and it is not triggerable by malicious document input. This vulnerability is fixed in 1.19.4.
Other sources
Nokogiri: Possible Use-After-Free when directly using NokogirI::XML::XPathContext beyond document lifetime
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.19.4-1 - Upgrade
Upgrade
Nokogirito a version that resolves this vulnerability.Fixed in 1.19.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57437?
CVE-2026-57437 has a risk rating of 17, indicating a significant vulnerability.
How do I fix CVE-2026-57437?
To fix CVE-2026-57437, update Nokogiri to version 1.19.4 or later.
What happens if I don't address CVE-2026-57437?
Failing to address CVE-2026-57437 could lead to potential use-after-free vulnerabilities in your applications.
Who is affected by CVE-2026-57437?
Any application using Nokogiri versions prior to 1.19.4 is affected by CVE-2026-57437.
What is the impact of CVE-2026-57437?
The impact of CVE-2026-57437 includes potential crashes or unexpected behavior when evaluating XPath expressions after the source document has been garbage collected.