CVE-2026-126064

Name of the Vulnerable Software and Affected Versions Nokogiri versions prior to 1.19.5

Description The CRuby native extension can leave Ruby wrappers pointing to freed memory when replacing an existing attribute value. This occurs when the Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang= functions are used after code has already accessed the attribute's child nodes. Replacing the value frees the native child nodes while their wrappers remain reachable, which can lead to an invalid read or a process segfault (a specific type of crash where a program tries to access a memory location it is not allowed to). JRuby is not affected.

Recommendations Update to version 1.19.5 or later. As a temporary workaround, avoid accessing attribute child nodes directly via Attr#children or similar before replacing the same attribute's value.