Executive brief
Nokogiri is a widely used Ruby library for processing XML and HTML documents. A technical flaw in how the library handles document encoding can lead to application crashes or the accidental leakage of small amounts of internal memory. This issue only occurs if an application attempts to set an invalid encoding, fails, and then continues to use the same document object.
Technical details
A Use-After-Free (CWE-416) vulnerability exists in the CRuby (libxml2) implementation of Nokogiri. When `Document#encoding=` is called with an invalid argument (such as a non-string or a string containing a null byte), the library frees the existing encoding string before validating the new input. If validation fails and an exception is raised, the document's internal pointer still references the freed memory. Subsequent calls to `Document#encoding` will perform a read on this invalid memory, which can result in a segmentation fault or the leakage of freed bytes into a Ruby String. This issue is fixed in version 1.19.4.
Affected products
- sparklemotion Nokogiri < 1.19.4
Timeline
- 2026-06-18: advisory: GitHub Security Advisory published by maintainers
- 2026-06-25: disclosed: CVE published to NVD