CVE-2026-57437: Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime

Published Jun 25, 2026
·
Updated

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::XPathContext did not keep its source document alive for garbage collection. If an XPathContext outlived its document and the document was collected, evaluating an XPath expression could read invalid memory and potentially segfault. This is only reachable when application code constructs an XPathContext directly and lets the document become unreachable while continuing to use the context. The normal Document#xpath, #css, and related search methods are not affected, and it is not triggerable by malicious document input. This vulnerability is fixed in 1.19.4.

Other sources

Nokogiri: Possible Use-After-Free when directly using NokogirI::XML::XPathContext beyond document lifetime

Microsoft

Affected Software

4 affected componentsFixes available
Nokogiri Nokogiri<1.19.4
Nokogiri Nokogiri Ruby<1.19.4
Microsoft azl3 rubygem-nokogiri 1.15.4-1<1.19.4-1
1.19.4-1
IBM Aspera Faspex 5<=5.0.0 - 5.0.15.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1.19.4-1
  2. Upgrade

    Upgrade Nokogiri to a version that resolves this vulnerability.

    Fixed in 1.19.4

Event History

Jun 25, 2026
CVE Published
via MITRE·02:34 PM
Data Sourced
via MITRE·02:34 PM
DescriptionWeakness
Data Sourced
via NVD·03:16 PM
DescriptionSeverityWeaknessAffected Software
Jun 27, 2026
Data Sourced
via Microsoft·08:16 AM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·08:16 AM
DescriptionSeverity
Jul 20, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-57437?

CVE-2026-57437 has a risk rating of 17, indicating a significant vulnerability.

2

How do I fix CVE-2026-57437?

To fix CVE-2026-57437, update Nokogiri to version 1.19.4 or later.

3

What happens if I don't address CVE-2026-57437?

Failing to address CVE-2026-57437 could lead to potential use-after-free vulnerabilities in your applications.

4

Who is affected by CVE-2026-57437?

Any application using Nokogiri versions prior to 1.19.4 is affected by CVE-2026-57437.

5

What is the impact of CVE-2026-57437?

The impact of CVE-2026-57437 includes potential crashes or unexpected behavior when evaluating XPath expressions after the source document has been garbage collected.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203