CVE-2026-126064
Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Node#[]=` or `#lang=`
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, the CRuby native extension can leave Ruby wrappers pointing to freed memory when Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang= replaces an existing attribute value after code has accessed the attribute's child nodes. Replacing the value frees native child nodes while their wrappers remain reachable, and later use of those wrappers can cause an invalid read or process segfault. JRuby is not affected. This issue is fixed in version 1.19.5.
| CWE | CWE-416 |
| Vendor | sparklemotion |
| Product | nokogiri |
| Published | Nov 10, 2026 |
| Last Updated | Nov 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for sparklemotion nokogiri
Be the first to know when new unknown vulnerabilities affecting sparklemotion nokogiri are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
sparklemotion / nokogiri
< 1.19.5
References
github.com: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-3w22-6jfg-527w github.com: https://github.com/sparklemotion/nokogiri/pull/3752 github.com: https://github.com/sparklemotion/nokogiri/commit/b15b518db9fd15fd6b046f73d1439c282e5cc425 github.com: https://github.com/sparklemotion/nokogiri/commit/feaed3c8c9bd9d81d064d4ca09b16044cd705d6f github.com: https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5