Vulnerability Description
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri’s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, Nokogiri::XML::Attr#value= could free the underlying native child node while the wrapper remained reachable through the document node cache. A later use of the freed child node or a Ruby GC mark could dereference an invalid pointer, causing an invalid read and a possible segfault. This vulnerability is fixed in 1.19.4.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nokogiri | Nokogiri | < 1.19.4 |
Related Weaknesses (CWE)
References
- https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-phwj-rprq-35pMitigationVendor Advisory
FAQ
What is CVE-2026-57435?
CVE-2026-57435 is a vulnerability with a CVSS score of 7.5 (HIGH). Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri’s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing...
How severe is CVE-2026-57435?
CVE-2026-57435 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-57435?
Check the references section above for vendor advisories and patch information. Affected products include: Nokogiri Nokogiri.