Invalid Memory Read in Nokogiri Versions Affects CRuby Users

CVE-2026-79769

What is CVE-2026-79769?

Nokogiri versions prior to 1.19.4 include a flaw in the Node#initialize_copy_with_args method, allowing a potential out-of-bounds memory read. This occurs when an application mistakenly utilizes a non-Node argument, such as a Namespace, leading to the reading of memory associated with xmlNs beyond its intended bounds. While this issue cannot be exploited via untrusted input or standard API usage, it significantly impacts developers due to its dependence on programming errors. Version 1.19.4 rectifies this by implementing a necessary type check, enforcing better type safety during method calls.

References