Memory Management Vulnerability in Nokogiri Library for Ruby

CVE-2026-57437

What is CVE-2026-57437?

Nokogiri, an open-source XML and HTML library for Ruby, has a vulnerability related to memory management in versions prior to 1.19.4. Specifically, the Nokogiri::XML::XPathContext class fails to maintain the source document in memory, which can result in the evaluation of XPath expressions operating on invalid memory once the source document is garbage collected. This scenario typically arises when applications manually create an XPathContext and allow the associated document to become unreachable while still using the context. This vulnerability does not affect standard methods like Document#xpath and #css, and it cannot be triggered by malicious document inputs.

References