CVE-2026-57438

Name of the Vulnerable Software and Affected Versions Nokogiri versions prior to 1.19.4

Description An issue exists in the XInclude substitution process where the do xinclude() function in Nokogiri::XML::Node replaces each <xi:include> element in place. This process frees the include node, its children (such as <xi:fallback> and its descendants), and any associated namespaces. If an application has already exposed these nodes or namespaces to Ruby, the resulting Ruby object points to freed memory, which can lead to invalid memory reads or writes.

Recommendations Update to version 1.19.4.