Use After Free Affecting nokogiri package, versions <1.19.4
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUBY-NOKOGIRI-17391937
- published21 Jun 2026
- disclosed19 Jun 2026
- creditZheng Yu
Introduced: 19 Jun 2026
New CVE NOT AVAILABLE CWE-416 (opens in a new tab)How to fix?
Upgrade nokogiri to version 1.19.4 or higher.
Overview
nokogiri is a gem for parsing HTML, XML, SAX, and Reader.
Affected versions of this package are vulnerable to Use After Free in the do_xinclude. An attacker can cause invalid memory reads or writes by exposing nodes or namespaces to Ruby before invoking XInclude processing.
Note: This is only exploitable if an application parses a document without XInclude, traverses into an <xi:include> subtree to expose its nodes or namespaces to Ruby, and only then invokes XInclude processing.
Workaround
This vulnerability can be mitigated by performing XInclude substitution at parse time using the xinclude parse option, rather than calling do_xinclude on a document that has already been traversed.