Executive brief
Nokogiri is a widely-used XML parsing library for Ruby applications. The canonicalize method, which is used to normalize XML for cryptographic signature validation, returns an empty string instead of raising an error when canonicalization fails. This defect allows attackers to bypass signature validation in SAML authentication systems, potentially enabling account takeover or unauthorized access to protected resources.
Technical details
The vulnerability is an unchecked return value (CWE-252) in Nokogiri's C extension for XML canonicalization. The canonicalize method on Nokogiri::XML::Document and Nokogiri::XML::Node fails to check the return value of the underlying xmlC14NExecute function; when canonicalization fails, the method silently returns an empty string instead of raising an exception. The attack is network-accessible and requires no authentication or user interaction—an attacker can exploit this by providing specially crafted XML input to an application using Nokogiri for SAML signature validation. The practical impact is signature validation bypass in downstream SAML libraries, as demonstrated in real-world exploits. The CRuby extension is affected in versions 1.5.1 through 1.19.0; JRuby is not affected. The fix is available in Nokogiri 1.19.1 and later.
Affected products
- Nokogiri Nokogiri >= 1.5.1, < 1.19.1
Timeline
- 2026-02-16: disclosed: Original advisory GHSA-wx95-c6cv-8532 published
- 2026-02-16: patched: Fix available in Nokogiri 1.19.1
- 2026-08-25: other: Duplicate advisory GHSA-xqqh-3w52-q8p7 published
- 2026-09-02: other: Duplicate advisory withdrawn