Executive brief
Nokogiri is a popular Ruby library used for parsing and manipulating XML and HTML documents. A memory safety issue was identified where certain programming errors could cause the application to crash or behave unpredictably during memory cleanup. This occurs when a developer incorrectly assigns a non-element node (like a DTD) as the document root, but it cannot be triggered directly by external users or untrusted input data.
Technical details
A heap use-after-free vulnerability exists in the CRuby (libxml2) implementation of Nokogiri when setting the document root. The `Nokogiri::XML::Document#root=` method failed to sufficiently validate node types, allowing a DTD node to be assigned as the root. This leads to memory corruption during garbage collection or finalization, potentially resulting in an invalid memory read or a segmentation fault. The vulnerability is only reachable through application code that performs this specific invalid assignment; it is not triggerable via untrusted XML input. The issue is resolved in version 1.19.4, which now raises a `TypeError` for invalid node types.
Affected products
- sparklemotion Nokogiri < 1.19.4
Timeline
- 2026-06-18: disclosed
- 2026-06-19: advisory
- 2026-06-19: patched: Fixed in version 1.19.4