CVE-2026-57436: Nokogiri XML/HTML Library Use-After-Free Vulnerability

Technical summary

CVE-2026-57436 is a use-after-free vulnerability in Nokogiri's Nokogiri::XML::Document#root= method. Prior to version 1.19.4, the method validated incoming arguments only by checking if they were instances of Nokogiri::XML::Node, without verifying whether the node type was appropriate for document root assignment. A DTD node, while technically a Node subclass, is not a valid document root. When such a node is improperly set as the root, subsequent garbage collection or object finalization triggers a heap use-after-free condition (CWE-416), leading to invalid memory access and potential segmentation faults. The fix implements stricter type validation to reject invalid node types before assignment.

Business impact

Ruby applications relying on Nokogiri for XML/HTML processing face availability risk if attackers can supply malformed documents. A successful exploit causes application crashes, resulting in service disruptions. Web services, document processors, and data parsing pipelines built on Nokogiri are most affected. The moderate CVSS score reflects the availability impact; there is no confidentiality or integrity compromise. Organizations should prioritize upgrading to mitigate denial-of-service scenarios, particularly if user-supplied content is processed.

Affected systems

Nokogiri versions before 1.19.4 are vulnerable. The library is widely used across Ruby on Rails applications, content management systems, API services, and data processing scripts. Any Ruby application using Nokogiri for XML/HTML parsing without pinning to version 1.19.4 or later is at risk.

Exploitability

Exploitation requires the ability to supply or influence XML/HTML documents processed by a vulnerable Nokogiri instance. Network vector indicates remote exploitation is possible if the application accepts untrusted input over the network (e.g., API endpoints, file upload features, or web scrapers). No authentication or user interaction is required. However, the attack results in denial of service rather than code execution or data breach, limiting the scope of impact. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Upgrade Nokogiri to version 1.19.4 or later. This is a straightforward remediation requiring a dependency update and testing in your application environment. Ruby developers should update their Gemfile and run bundle update nokogiri, then redeploy affected services. No configuration changes or workarounds are necessary.

Patch guidance

Update Nokogiri to version 1.19.4 or any later version. For Ruby projects, modify your Gemfile to specify gem 'nokogiri', '~> 1.19.4' or higher, then execute bundle update nokogiri. Test the upgrade in a staging environment to ensure compatibility with your application, particularly if you have custom XML/HTML parsing logic or rely on specific Nokogiri APIs. Verify that document root operations continue to function as expected after the update.

Detection guidance

Monitor your Ruby dependency inventory for Nokogiri versions below 1.19.4 using software composition analysis (SCA) tools such as Bundler-audit, Dependabot, or Snyk. In production environments, observe application error logs for segmentation faults or heap corruption messages originating from Nokogiri operations, particularly when processing untrusted XML/HTML documents. Intrusion detection systems are unlikely to identify this vulnerability reliably since it manifests as memory corruption rather than network-level attack patterns; focus on preventive patching rather than runtime detection.

Why prioritize this

Although the CVSS score is moderate (5.3), this vulnerability warrants prompt attention because (1) Nokogiri is a foundational dependency in many Ruby applications, (2) exploitation is effortless given network vector and no authentication requirement, and (3) the fix is simple and low-risk. The lack of KEV status does not diminish urgency—patching should be completed within your standard maintenance cycle, ideally within 2–4 weeks for non-critical systems and 1–2 weeks for internet-facing services processing untrusted input.

Risk score, explained

CVSS 5.3 (Medium) reflects a network-accessible vulnerability with low complexity and no privilege/interaction barriers, but limited impact scope (availability only, no C/I). The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L confirms remote exploitability and denial-of-service outcome. The score appropriately balances the ease of triggering the bug against the limited severity of the resulting crash. In context, organizations processing untrusted documents should treat this as higher priority despite the moderate base score.

Frequently asked questions