CVE-2026-57435CWE-416CWE-825

Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`

Low · published June 25, 2026

CVSS v4.0
1.7
EPSS
0%
Percentile
38.9
In the wild
Unconfirmed
What it is

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri’s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, Nokogiri::XML::Attr#value= could free the underlying native child node while the wrapper remained reachable through the document node cache. A later use of the freed child node or a Ruby GC mark could dereference an invalid pointer, causing an invalid read and a possible segfault. This vulnerability is fixed in 1.19.4.

The record
Technical detail
CVSS v4.0
1.7 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
EPSS
0.00460 · 38.9th percentile
Weaknesses
CWE-416 · Use After Free; CWE-825 · Expired Pointer Dereference
Published
2026-06-25T14:32Z
EPSS history
Timeline
  • 25 JUN 14:32Z
    Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`
    cvelistv5