CVE-2026-57438: Nokogiri: Possible Use-After-Free in XInclude Processing
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, XInclude substitution performed by Nokogiri::XML::Node#doxinclude replaced each <xi:include> in place, freeing the include node along with its children (such as <xi:fallback> and its descendants) and any namespaces declared on them. If an application had already exposed one of those nodes or namespaces to Ruby, the corresponding Ruby object was left pointing at freed memory. Using the object could result in invalid reads or writes to memory. This vulnerability is fixed in 1.19.4.
Other sources
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, XInclude substitution performed by Nokogiri::XML::Node#doxinclude replaced each xi:include in place, freeing the include node along with its children (such as xi:fallback and its descendants) and any namespaces declared on them. If an application had already exposed one of those nodes or namespaces to Ruby, the corresponding Ruby object was left pointing at freed memory. Using the object could result in invalid reads or writes to memory. This vulnerability is fixed in 1.19.4.
— IBM
Nokogiri: Possible Use-After-Free in XInclude Processing
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.19.4-1 - Upgrade
Upgrade
Nokogirito a version that resolves this vulnerability.Fixed in 1.19.4
Event History
Frequently Asked Questions
What is CVE-2026-57438?
CVE-2026-57438 is a vulnerability in Nokogiri affecting versions prior to 1.19.4 that involves a possible use-after-free condition during XInclude processing.
What is the severity of CVE-2026-57438?
CVE-2026-57438 has a low severity rating of 2.2 according to the CVSS scoring system.
How do I fix CVE-2026-57438?
To fix CVE-2026-57438, users should upgrade Nokogiri to version 1.19.4 or later.
What type of vulnerability is CVE-2026-57438 classified as?
CVE-2026-57438 is classified as a Use After Free vulnerability.
Which software versions are affected by CVE-2026-57438?
CVE-2026-57438 affects Nokogiri versions prior to 1.19.4.