Executive brief
Nokogiri is a popular Ruby library used for processing XML and HTML documents. A technical issue was found where certain advanced search operations could try to access memory that has already been cleared by the system, potentially causing the application to crash. This only occurs in very specific, non-standard programming patterns and does not affect the library's primary search functions or typical web processing tasks.
Technical details
A use-after-free vulnerability (CWE-416) exists in the CRuby implementation of Nokogiri. The `Nokogiri::XML::XPathContext` class failed to maintain a reference to its source document, allowing the Ruby garbage collector to reclaim the document's memory while the context was still in use. If an application manually constructs an `XPathContext` and the parent document is collected, subsequent XPath evaluation attempts to read invalid memory, potentially leading to a segmentation fault. This issue does not affect standard high-level methods like `Document#xpath` or `Document#css`. The vulnerability is patched in version 1.19.4 by ensuring the context keeps the source document alive.
Affected products
- sparklemotion Nokogiri < 1.19.4
Timeline
- 2026-06-18: disclosed: Reported by Zheng Yu from depthfirst.com
- 2026-06-19: advisory
- 2026-06-19: patched: Fixed in version 1.19.4