CVE-2026-57436

Name of the Vulnerable Software and Affected Versions Nokogiri versions prior to 1.19.4

Description In the Nokogiri XML and HTML library for Ruby, the root= method of Nokogiri::XML::Document only validates that the new root is a Nokogiri::XML::Node. This allows a DTD (Document Type Definition) node to be set as the document root, resulting in a heap use-after-free during garbage collection or finalization. This condition can lead to an invalid memory read or a segmentation fault (segfault), which is an abrupt termination of a program due to an illegal memory access.

Recommendations Update to version 1.19.4.