Memory Management Issue in Nokogiri Library for Ruby

CVE-2026-126064

What is CVE-2026-126064?

Nokogiri, an open-source library for parsing XML and HTML in Ruby, has a vulnerability where the native extension can leave Ruby wrappers referencing freed memory. This occurs when the method Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang= modifies an existing attribute after child nodes have been accessed. This behavior can result in invalid reads or segmentation faults if the freed memory is later accessed through these wrappers. The issue has been resolved in version 1.19.5, and users are advised to upgrade to this version or later to mitigate potential risks.

References