Rubygems · Nokogiri · CVE-2026-57436
**Name of the Vulnerable Software and Affected Versions**
Nokogiri versions prior to 1.19.4
**Description**
In the Nokogiri XML and HTML library for Ruby, the `root=` method of `Nokogiri::XML::Document` only validates that the new root is a `Nokogiri::XML::Node`. This allows a DTD (Document Type Definition) node to be set as the document root, resulting in a heap use-after-free during garbage collection or finalization. This condition can lead to an invalid memory read or a segmentation fault (segfault), which is an abrupt termination of a program due to an illegal memory access.
**Recommendations**
Update to version 1.19.4.