# CVE-2026-79769: Nokogiri invalid memory read in Node#initialize_copy_with_args

Source: https://junglewise.ai/threats/cve-2026-79769-nokogiri-invalid-memory-read-in-node-initialize-copy-with-args  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-79769 · Severity: medium · CVSS 5.5 · Published 2026-08-25

Nokogiri is a popular XML/HTML parsing library used in Ruby applications. A type confusion bug in an internal copy helper method can cause a memory read error and crash the process when called with an incorrect argument type. This vulnerability requires application code to make a programming error (calling a protected internal method with a wrong type), and cannot be exploited through untrusted input or normal API use.

## Quick answers

**Is CVE-2026-79769 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-79769 being exploited in the wild.

**How severe is CVE-2026-79769?** Medium severity, with a CVSS score of 5.5, published 25 August 2026.

**Which products and versions are affected?** Nokogiri Nokogiri before 1.19.4.

**Is there a fix for CVE-2026-79769?** A patch was published on 2026: Fix available in Nokogiri 1.19.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-79769 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-79769?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a type confusion vulnerability (CWE-843) in the protected Node#initialize_copy_with_args helper method, which backs the public Node#dup and #clone methods. The vulnerable code unwraps the source argument as an xmlNode pointer without validating the argument type first. When a non-Node object (such as a Namespace) is passed, the code reads from an incompatible memory structure (xmlNs), resulting in an out-of-bounds read that crashes the process. Only CRuby is affected; JRuby is not impacted. The vulnerability is only reachable via intentional programmer error calling the protected internal method directly, not through untrusted input or normal public API usage. Nokogiri 1.19.4 fixes this by adding a type check that raises TypeError for invalid argument types.

## Affected products

- Nokogiri Nokogiri before 1.19.4

## Timeline

- 2026-06-18: disclosed: GitHub Security Advisory GHSA-g9g8-vgvw-g3vf published
- 2026-08-25: advisory: CVE-2026-79769 assigned and published on NVD
- 2026: patched: Fix available in Nokogiri 1.19.4

## References

- [https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-g9g8-vgvw-g3vf](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-g9g8-vgvw-g3vf)
- [https://www.vulncheck.com/advisories/nokogiri-before-invalid-memory-read-via-initialize-copy-with-args](https://www.vulncheck.com/advisories/nokogiri-before-invalid-memory-read-via-initialize-copy-with-args)