CVE-2026-57435

Name of the Vulnerable Software and Affected Versions Nokogiri versions prior to 1.19.4

Description The CRuby native extension of this XML and HTML library can leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code has already accessed an attribute child node, the Nokogiri::XML::Attr#value= function could free the underlying native child node while the wrapper remains reachable through the document node cache. Subsequent use of the freed child node or a Ruby GC mark may dereference an invalid pointer, leading to an invalid read and a potential segfault (a specific type of crash caused by accessing memory that the program does not have permission to access).

Recommendations Update to version 1.19.4.