Nokogiri NULL pointer dereference in uninitialized XML Node wrapper classes

Executive brief

Nokogiri is a popular Ruby library used for parsing and manipulating XML and HTML documents. A bug exists where certain programming errors in application code can cause the software to crash. This occurs when a developer incorrectly initializes specific internal components of the library, potentially leading to a denial-of-service for the affected application.

Technical details

A NULL pointer dereference exists in Nokogiri's native wrapper classes. The vulnerability is triggered when application code calls the `.allocate` method directly on a native-backed class (inheriting from `Nokogiri::XML::Node`) and subsequently invokes methods on that uninitialized object. This bypasses the standard constructor/factory methods, leaving the underlying native data pointer uninitialized. An attacker cannot trigger this via untrusted input; it requires a specific programming pattern in the host application. Version 1.19.4 mitigates this by checking for missing native data pointers and raising a `RuntimeError` instead of crashing.

Affected products

• sparklemotion nokogiri < 1.19.4

Timeline

• 2026-06-18: disclosed
• 2026-06-19: advisory
• 2026-06-19: patched: Fixed in version 1.19.4

References

• https://api.github.com/users/cla7aye15I4nd
• https://github.com/cla7aye15I4nd
• https://api.github.com/users/cla7aye15I4nd/gists%7B/gist_id%7D
• https://api.github.com/users/cla7aye15I4nd/repos
• https://avatars.githubusercontent.com/u/17133261?v=4
• https://api.github.com/users/cla7aye15I4nd/events%7B/privacy%7D