CVE-2026-57236: Nokogiri Use-After-Free in Document Encoding (CVSS 8.2)

Technical summary

CVE-2026-57236 is a use-after-free vulnerability (CWE-416) in Nokogiri's Document#encoding= method. The vulnerability occurs in the setter logic: when an invalid encoding argument is supplied (non-string type or string containing a null byte), an exception is raised after the document's existing encoding pointer is deallocated but before a valid replacement is assigned. This leaves the internal encoding reference dangling. A subsequent call to read Document#encoding will dereference the freed memory region, leading to either a segmentation fault or uncontrolled information disclosure as freed heap bytes are materialized into Ruby String objects. The defect exists only in CRuby's native libxml2 binding; the pure-Java JRuby implementation is not affected. The CVSS 3.1 score of 8.2 reflects moderate attack complexity (network-accessible, no authentication required) coupled with high availability impact and low confidentiality impact.

Business impact

Organizations deploying Nokogiri in production Ruby applications face two primary risks: availability loss through segmentation faults if untrusted or malformed XML/HTML input reaches the encoding setter, and potential information disclosure if application state in freed memory is leaked into accessible strings. If Nokogiri is embedded in a web service, an attacker could trigger a denial-of-service condition by supplying crafted input that causes the application to crash. For applications processing sensitive data (credentials, PII, financial records) using Nokogiri, memory disclosure is a secondary concern, though likelihood depends on the application's input validation posture and whether untrusted user data can be directly converted to encoding parameters.

Affected systems

The vulnerability affects Nokogiri versions prior to 1.19.4 running on CRuby (the standard C implementation of Ruby). Any Rails application, Ruby microservice, or standalone Ruby script using Nokogiri for XML/HTML parsing on CRuby is in scope. JRuby deployments are explicitly unaffected. Versions 1.19.4 and later have addressed the issue and should be considered safe.

Exploitability

Exploitation requires only that untrusted or specially-crafted data reach the Document#encoding= method with an invalid argument type or value. No authentication, user interaction, or special privileges are required; the flaw is directly reachable via network if Nokogiri parses externally-supplied content and any code path leads to setting an encoding with attacker-controlled input. The CVSS vector (AV:N/AC:L) confirms this. In practice, many applications use fixed, valid encodings and may not expose the setter to untrusted input, which would reduce risk in those contexts. However, any application accepting user-supplied encoding hints or configuration for document processing should be considered vulnerable if running unpatched Nokogiri.

Remediation

Update Nokogiri to version 1.19.4 or later. For Rails applications, update the gemfile to `gem 'nokogiri', '~> 1.19.4'` (or newer) and run `bundle update nokogiri`. Standalone Ruby projects should update via `gem update nokogiri` or similar package management. If immediate patching is not feasible, mitigate by validating encoding input before passing it to Document#encoding=; explicitly reject non-string values and scan for null bytes in encoding name strings. This defense-in-depth approach reduces exposure even on unpatched versions.

Patch guidance

Nokogiri 1.19.4 is the fixed version. Verify your current version with `gem list nokogiri` or `require 'nokogiri'; puts Nokogiri::VERSION` in irb. Update using your standard gem or bundler workflow. After updating, restart any running application processes. No configuration changes are required post-patch; the fix is internal to the encoding setter logic.

Detection guidance

Monitor application logs and error reporting systems for segmentation faults (SIGSEGV) or crashes in Nokogiri's XML parsing flow, especially if correlated with processing of external or user-supplied content. If using Nokogiri in a web service context, look for HTTP error rates or process restarts that coincide with document parsing operations. Code review can identify call sites where Document#encoding= is invoked with user input or untrusted data. Static analysis tools may flag insecure encoding assignments. No specific IDS/IPS signatures are currently required, as the flaw is triggered only by invalid argument types rather than specific byte sequences.

Why prioritize this

Although this vulnerability requires untrusted data to reach a specific setter method, the combination of ease of exploitation (AC:L), high availability impact, and presence in a widely-used library warrants prompt patching. Organizations should prioritize this during their next maintenance window, particularly if Nokogiri is used in Internet-facing services or processes user-supplied XML/HTML. Teams with strong input validation may see this as lower priority, but security-conscious organizations should patch proactively to eliminate the risk surface entirely.

Risk score, explained

The CVSS 3.1 score of 8.2 (HIGH severity) reflects several factors: the vulnerability is network-reachable (AV:N) with low attack complexity (AC:L), requires no authentication or user interaction (PR:N/UI:N), and impacts the entire application scope (S:U). While confidentiality impact is rated Low (due to unpredictable memory contents), the Availability impact is High (segfault = denial of service). The moderate-to-high score appropriately captures the real-world risk: a realistic attack vector combined with significant service disruption potential.

Frequently asked questions