CVE-2026-79771: Nokogiri XSLT Stylesheet transform memory leak

CVE-2026-79771 · Severity: medium · CVSS 5.3 · Published 2026-08-25

Nokogiri's XSLT transform functionality leaks small heap allocations (24–32 bytes each) when processing Ruby strings containing null bytes. While individual leaks are tiny, sustained attacker-controlled traffic at high call rates in long-running applications can cause progressive memory growth, potentially leading to service degradation or crashes. The vulnerability requires direct exposure of user input to XSLT transform parameters, which affects applications that process untrusted XML transformation requests.

Technologies: nokogiri (RubyGems). Vendors: RubyGems.

Quick answers

Is CVE-2026-79771 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-79771 being exploited in the wild.
How severe is CVE-2026-79771?
Medium severity, with a CVSS score of 5.3, published 25 August 2026.
Which products and versions are affected?
nokogiri (RubyGems) < 1.19.3, ECOSYSTEM:introduced=0,fixed=1.19.3.
Is there a fix for CVE-2026-79771?
Yes. nokogiri (RubyGems): upgrade to 1.19.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79771 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-79771?
Check whether you run nokogiri (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nokogiri (RubyGems): upgrade to 1.19.3 or later
    bundle update nokogiri

Technical details

The vulnerability is a memory leak (CWE-401) in Nokogiri's XSLT transform implementation. When the transform method receives a Ruby string parameter containing a null byte, it fails to release a heap allocation (approximately 24–32 bytes per occurrence). The bug is triggered on any call to Nokogiri::XSLT::Stylesheet#transform with crafted input, requiring no authentication or special privileges and reachable via network in web applications. Each individual leak is small, but sustained high-rate calls with attacker-controlled parameters can cause cumulative memory exhaustion in long-running processes. The vulnerability does not cause memory corruption, information disclosure, or behavioral changes to the transform itself; a string-handling exception is raised as expected. Patch available in Nokogiri version 1.19.3 and later.

Affected products

  • Sparklemotion Nokogiri < 1.19.3

Identifiers

  • CVE-2026-79771
  • GHSA-v2fc-qm4h-8hqv

Timeline

  • 2026-04-27: disclosed: Vulnerability published in GitHub Advisory Database
  • 2026-05-06: patched: Patch released in Nokogiri 1.19.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.