Nokogiri unchecked return value in canonicalize method

Severity: medium · CVSS 5.3 · Published 2026-08-25

Nokogiri is a widely-used XML parsing library for Ruby applications. The canonicalize method, which is used to normalize XML for cryptographic signature validation, returns an empty string instead of raising an error when canonicalization fails. This defect allows attackers to bypass signature validation in SAML authentication systems, potentially enabling account takeover or unauthorized access to protected resources.

Technologies: nokogiri (RubyGems). Vendors: RubyGems.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Medium severity, with a CVSS score of 5.3, published 25 August 2026.
Which products and versions are affected?
nokogiri (RubyGems) >= 1.5.1, < 1.19.1.
Is there a fix for This vulnerability?
A patch was published on 2026-02-16: Fix available in Nokogiri 1.19.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run nokogiri (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an unchecked return value (CWE-252) in Nokogiri's C extension for XML canonicalization. The canonicalize method on Nokogiri::XML::Document and Nokogiri::XML::Node fails to check the return value of the underlying xmlC14NExecute function; when canonicalization fails, the method silently returns an empty string instead of raising an exception. The attack is network-accessible and requires no authentication or user interaction—an attacker can exploit this by providing specially crafted XML input to an application using Nokogiri for SAML signature validation. The practical impact is signature validation bypass in downstream SAML libraries, as demonstrated in real-world exploits. The CRuby extension is affected in versions 1.5.1 through 1.19.0; JRuby is not affected. The fix is available in Nokogiri 1.19.1 and later.

Affected products

  • Nokogiri Nokogiri >= 1.5.1, < 1.19.1

Timeline

  • 2026-02-16: disclosed: Original advisory GHSA-wx95-c6cv-8532 published
  • 2026-02-16: patched: Fix available in Nokogiri 1.19.1
  • 2026-08-25: other: Duplicate advisory GHSA-xqqh-3w52-q8p7 published
  • 2026-09-02: other: Duplicate advisory withdrawn

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.