CVE-2026-79769

Name of the Vulnerable Software and Affected Versions Nokogiri versions prior to 1.19.4

Description An invalid out-of-bounds memory read exists in the protected internal Node#initialize copy with args helper, which is utilized by Node#dup and #clone. The issue occurs because the helper unwraps its source argument as an xmlNode without performing a type check. If the method is called with a non-Node argument, such as a Namespace, the process reads an xmlNs out of bounds, leading to a crash. This issue is specific to CRuby and is only triggerable via a programming error, as it cannot be exploited through untrusted input or standard use of the public API.

Recommendations Update Nokogiri to version 1.19.4 or later.