CVE-2026-57438: Nokogiri XInclude Use-After-Free Vulnerability (CVSS 6.6)

Technical summary

CVE-2026-57438 is a use-after-free vulnerability (CWE-416) in Nokogiri's XInclude substitution handler. The Nokogiri::XML::Node#do_xinclude method replaces xi:include elements in place and deallocates the include node, its children (including xi:fallback descendants), and associated namespace declarations. If a Ruby application has already exposed references to these freed nodes or their namespace objects before XInclude processing completes, those Ruby objects become dangling pointers. Subsequent operations on such objects cause invalid memory access, potentially enabling out-of-bounds reads or writes. The vulnerability exists in versions prior to 1.19.4.

Business impact

Applications using Nokogiri to process XML documents with XInclude directives face availability and data integrity risks. A crafted or legitimate XML document that triggers XInclude substitution could cause application crashes if the affected code path is exercised. In scenarios where memory corruption leads to uncontrolled writes, there is a narrow but non-zero risk of information disclosure or application state corruption. Organizations that store or process sensitive XML data using vulnerable versions should treat this as a moderate-priority issue, particularly if user-supplied XML is processed with XInclude enabled.

Affected systems

Nokogiri versions prior to 1.19.4 are affected. This includes all 1.x versions up to and including 1.19.3. Ruby applications that use Nokogiri for XML or HTML parsing—especially those that rely on XInclude functionality—are in scope. The vulnerability requires application code to explicitly process XInclude directives (via do_xinclude) and retain references to included nodes or their namespaces, making it somewhat niche but not rare in document processing workflows.

Exploitability

The vulnerability requires local code execution context (the CVSS vector specifies AV:L, local access vector) and low privileges (PR:L). An attacker cannot exploit this remotely by simply sending malicious XML to an exposed service; rather, an authenticated or local user must trigger XInclude processing on a specially crafted XML document while the application maintains references to the affected nodes. The attack surface is limited to applications that both parse XInclude directives and expose intermediate node references to user-accessible code. This is not a trivial exploit path, but it is achievable in multi-tenant or shared hosting scenarios.

Remediation

Upgrade Nokogiri to version 1.19.4 or later. This patch version includes memory management fixes that ensure freed nodes are properly invalidated in the Ruby layer, preventing use-after-free conditions. Organizations should coordinate patching with their Ruby application deployments, as Nokogiri is a native extension that may require compilation during install.

Patch guidance

Apply Nokogiri version 1.19.4 or newer. Verify the patch version by checking your Gemfile.lock (for Bundler-managed projects) or running `gem list nokogiri` in your Ruby environment. For containerized deployments, rebuild images with the patched gem version. If Nokogiri is vendored within your application, regenerate the lock file and commit the upgrade. Test XML processing workflows that rely on XInclude to confirm no regressions are introduced.

Detection guidance

Review application code for calls to do_xinclude on XML documents. Check whether your Ruby code exposes or stores references to nodes, attributes, or namespace objects that might originate from XInclude-processed XML. If your application processes XML from untrusted sources and retains node references, prioritize patching. For runtime detection, monitor application logs for segmentation faults or memory corruption errors that coincide with XML processing tasks. SIEM rules should flag unexpected crashes in Ruby processes handling XML data.

Why prioritize this

Although the CVSS score is moderate (6.6), the confluence of memory safety issues with local privileges and high availability impact (the A:H component) warrants prompt attention. Organizations should prioritize patching within 30 days, especially if XInclude is actively used. The lack of KEV designation indicates limited public exploitation, but memory corruption flaws tend to receive researcher focus over time.

Risk score, explained

The CVSS 3.1 score of 6.6 (MEDIUM) reflects the local attack vector, low privilege requirement, and lack of user interaction, balanced against the high availability impact and confidentiality/integrity concerns. The low attack complexity and no-scope constraint limit the severity from HIGH to MEDIUM. However, the use-after-free nature of the flaw elevates practical risk in memory-critical environments; defenders should not view MEDIUM severity as low priority.

Frequently asked questions