Use After Free Affecting nokogiri package, versions [,1.19.4)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-UNMANAGED-NOKOGIRI-17391936
- published21 Jun 2026
- disclosed19 Jun 2026
- creditZheng Yu
Introduced: 19 Jun 2026
CVE NOT AVAILABLE CWE-416 (opens in a new tab)How to fix?
Upgrade nokogiri to version 1.19.4 or higher.
Overview
Affected versions of this package are vulnerable to Use After Free when the Document#encoding= raises an exception after receiving an invalid encoding value, which results in the document referencing freed memory. An attacker can cause a segmentation fault or leak freed memory contents by passing specially crafted input and continuing to use the affected document after rescuing the exception.
Note: This is only exploitable if an invalid encoding is passed to Document#encoding=, the resulting exception is rescued, and the same document is used afterwards.
Workaround
This vulnerability can be mitigated by avoiding passing attacker-controlled values to Document#encoding=.