Executive brief
Nokogiri is a widely used Ruby library for processing XML and HTML documents. A technical flaw in how it handles specific document inclusions could allow a program to crash or behave unpredictably by accessing memory that has already been cleared. This issue primarily affects applications using specific, non-standard processing sequences and is resolved by updating the library.
Technical details
A use-after-free (CWE-416) vulnerability exists in the CRuby implementation of Nokogiri's XInclude processing. When `Nokogiri::XML::Node#do_xinclude` is called, it replaces `<xi:include>` nodes in place and frees the original nodes and their descendants. If the application has already referenced these nodes in Ruby, the Ruby objects remain linked to the now-freed memory, leading to invalid memory reads or writes. This requires a specific execution flow where a document is parsed without XInclude, traversed to expose nodes to Ruby, and then subsequently processed for XInclude. The issue is fixed in version 1.19.4 by performing substitutions on defensive copies.
Affected products
- sparklemotion Nokogiri < 1.19.4
Timeline
- 2026-06-18: advisory: GitHub advisory published by maintainers
- 2026-06-25: disclosed: CVE published to NVD
- 2026-06-25: patched: Fixed in version 1.19.4