This advisory has been withdrawn because it is a duplicate of GHSA-v2fc-qm4h-8hqv. This link is maintained to preserve external references.

Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes.