Is CVE-2026-79772 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79772 being exploited in the wild.

How severe is CVE-2026-79772?

Medium severity, with a CVSS score of 5.3, published 25 August 2026.

Which products and versions are affected?

nokogiri (RubyGems) >= 1.5.1, < 1.19.1, ECOSYSTEM:introduced=1.5.1,fixed=1.19.1.

Is there a fix for CVE-2026-79772?

Yes. nokogiri (RubyGems): upgrade to 1.19.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-79772 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-79772?

Check whether you run nokogiri (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79772: Nokogiri CRuby unchecked return value in canonicalize

Q: Is there a fix for CVE-2026-79772?

Yes. nokogiri (RubyGems): upgrade to 1.19.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-79772 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-79772?

Check whether you run nokogiri (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79772 · Severity: medium · CVSS 5.3 · Published 2026-08-25

Nokogiri is a widely-used XML parsing library for Ruby applications. The library contains a flaw where XML canonicalization operations that should fail are silently returning empty strings instead. This allows applications that depend on Nokogiri for cryptographic signature validation—particularly SAML authentication systems—to incorrectly accept forged or tampered digital signatures, potentially enabling unauthorized access or account takeover.

Technologies: nokogiri (RubyGems). Vendors: RubyGems.

Quick answers

Is CVE-2026-79772 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79772 being exploited in the wild.
How severe is CVE-2026-79772?: Medium severity, with a CVSS score of 5.3, published 25 August 2026.
Which products and versions are affected?: nokogiri (RubyGems) >= 1.5.1, < 1.19.1, ECOSYSTEM:introduced=1.5.1,fixed=1.19.1.
Is there a fix for CVE-2026-79772?: Yes. nokogiri (RubyGems): upgrade to 1.19.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79772 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-79772?: Check whether you run nokogiri (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nokogiri (RubyGems): upgrade to 1.19.1 or later
```
bundle update nokogiri
```

Technical details

Nokogiri's CRuby extension implements the canonicalize() method for both Nokogiri::XML::Document and Nokogiri::XML::Node without checking the return value of the underlying xmlC14NExecute C library function. When canonicalization fails, the function returns an error code, but Nokogiri does not detect this and instead returns an empty string. This violates the principle of fail-secure error handling. An attacker can craft malformed XML that triggers canonicalization failure, causing Nokogiri to return an empty string that downstream libraries (particularly ruby-saml) may incorrectly interpret as a valid canonicalized form, bypassing SAML signature validation. The vulnerability requires network access to send a malicious SAML assertion and affects all CRuby versions from 1.5.1 through 1.19.0. The JRuby implementation is not affected as it correctly raises RuntimeError on failure. A fix is available in version 1.19.1.

Affected products

Sparklemotion Nokogiri >= 1.5.1, < 1.19.1

Identifiers

CVE-2026-79772
GHSA-wx95-c6cv-8532

Timeline

2026-02-18: disclosed: GitHub Advisory GHSA-wx95-c6cv-8532 published
2026-02-16: patched: Patch released in Nokogiri 1.19.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.