CVE-2026-57437

Name of the Vulnerable Software and Affected Versions Nokogiri versions prior to 1.19.4

Description In the Nokogiri XML and HTML library for Ruby, the Nokogiri::XML::XPathContext does not maintain a reference to its source document to prevent garbage collection. If an XPathContext persists after its associated document has been collected by the garbage collector, evaluating an XPath expression may result in reading invalid memory, potentially leading to a segmentation fault (segfault), which is a crash caused by accessing memory that the program is not allowed to access. This issue occurs only when application code directly instantiates an XPathContext and allows the document to become unreachable while the context is still in use. Standard search methods such as Document#xpath and Document#css are not affected, and the issue cannot be triggered via malicious document input.

Recommendations Update to version 1.19.4.