Nokogiri use-after-free when setting XML attribute values

Executive brief

Nokogiri is a popular Ruby library used for processing and searching XML and HTML documents. A technical flaw in how it handles document attributes could lead to application crashes (segmentation faults) under specific programming patterns. While the risk to data security is low, an exploit could impact the stability and availability of services that process untrusted XML data.

Technical details

A use-after-free vulnerability exists in Nokogiri's CRuby native extension when replacing the value of an XML attribute. The root cause is that the `Nokogiri::XML::Attr#value=` and `#content=` methods may free an underlying native child node while a Ruby wrapper for that node remains reachable in the document node cache. If the application subsequently accesses the freed child node or the Ruby Garbage Collector attempts to mark it, an invalid pointer dereference occurs, leading to an invalid read and potential process crash. This issue specifically affects the CRuby implementation; JRuby is not impacted. Users should upgrade to Nokogiri 1.19.4, which ensures child nodes are preserved during value replacement.

Affected products

• sparklemotion Nokogiri < 1.19.4

Timeline

• 2026-06-18: patched: Nokogiri 1.19.4 released
• 2026-06-19: disclosed: GitHub Advisory published

References

• https://api.github.com/users/cla7aye15I4nd
• https://github.com/cla7aye15I4nd
• https://api.github.com/users/cla7aye15I4nd/gists%7B/gist_id%7D
• https://api.github.com/users/cla7aye15I4nd/repos
• https://avatars.githubusercontent.com/u/17133261?v=4
• https://api.github.com/users/cla7aye15I4nd/events%7B/privacy%7D