Is CVE-2026-57437 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57437 being exploited in the wild.

How severe is CVE-2026-57437?

Medium severity, with a CVSS score of 4, published 25 June 2026.

Which products and versions are affected?

nokogiri (RubyGems) ECOSYSTEM:introduced=0,fixed=1.19.4.

Is there a fix for CVE-2026-57437?

Yes. nokogiri (RubyGems): upgrade to 1.19.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57437 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-57437?

Check whether you run nokogiri (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57437: Nokogiri use-after-free in XML::XPathContext

CVE-2026-57437 · Severity: medium · CVSS 4 · Published 2026-06-25

Nokogiri is a widely used Ruby library for processing XML and HTML documents. A technical flaw in how the library manages memory could cause an application to crash (segmentation fault) if it uses a specific, advanced programming pattern. This issue does not affect standard document searching and cannot be triggered by malicious user input alone; it requires a specific sequence of events in the application's own code.

Technologies: nokogiri (RubyGems). Vendors: RubyGems.

Quick answers

Is CVE-2026-57437 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57437 being exploited in the wild.
How severe is CVE-2026-57437?: Medium severity, with a CVSS score of 4, published 25 June 2026.
Which products and versions are affected?: nokogiri (RubyGems) ECOSYSTEM:introduced=0,fixed=1.19.4.
Is there a fix for CVE-2026-57437?: Yes. nokogiri (RubyGems): upgrade to 1.19.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57437 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-57437?: Check whether you run nokogiri (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nokogiri (RubyGems): upgrade to 1.19.4 or later
```
bundle update nokogiri
```

Technical details

A Use-After-Free (CWE-416) vulnerability exists in the CRuby implementation of Nokogiri. The `Nokogiri::XML::XPathContext` class failed to maintain a reference to its parent XML document, allowing the Ruby garbage collector to reclaim the document's memory while the context was still in use. If an application manually constructs an `XPathContext` and the source document is collected, subsequent XPath evaluations will read invalid memory, leading to a segmentation fault. This is not triggerable via malicious XML input and does not affect the high-level `Document#xpath` or `#css` methods. The issue is resolved in version 1.19.4 by ensuring the context keeps the source document alive.

Affected products

sparklemotion Nokogiri < 1.19.4

Identifiers

CVE-2026-57437
GHSA-p67v-3w7g-wjg7

Timeline

2026-06-18: advisory: GitHub advisory published by maintainers
2026-06-25: disclosed: CVE published to NVD

References

https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-p67v-3w7g-wjg7

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.