Executive brief
Nokogiri is a popular Ruby library used for parsing and manipulating XML and HTML documents. A memory management issue was discovered where certain document processing actions could cause the library to access memory that has already been cleared. While this could theoretically lead to application crashes or unexpected behavior, it requires a very specific and unusual sequence of programming steps to occur, making it unlikely to affect most standard implementations.
Technical details
A use-after-free vulnerability exists in Nokogiri's CRuby implementation during XInclude processing. When `Nokogiri::XML::Node#do_xinclude` is called, it replaces `<xi:include>` nodes in-place, which frees the original node and its descendants in the underlying libxml2 C library. If the application has already created Ruby-level references to these nodes or their namespaces before calling `#do_xinclude`, those Ruby objects will point to freed memory. An attacker who can influence the document structure and the specific API calling sequence could potentially trigger invalid memory reads or writes. The issue is mitigated in version 1.19.4 by performing substitutions on a defensive copy of the nodes.
Affected products
- sparklemotion Nokogiri < 1.19.4
Timeline
- 2026-06-18: disclosed
- 2026-06-19: advisory
- 2026-06-19: patched