Is there a patch available for CVE-2026-57434?

Yes, a patch is available for CVE-2026-57434. Update the affected software to the latest version immediately.

Nokogiri CVE-2026-57434

Q: What is the CVSS score of CVE-2026-57434?

CVE-2026-57434 has a CVSS 4.0 base score of 1.7 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-39424 LOW

NULL Pointer Dereference (CWE-476)

2026-06-25 GitHub_M

Denial Of Service Null Pointer Dereference Nokogiri Sparklemotion

1.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

1.7 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.7 LOW

AC:H reflects the specific developer anti-pattern prerequisite; A:L captures process-level crash only; no confidentiality or integrity impact applies.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 25, 2026 - 16:03 EUVD

Source Code Evidence Fetched

Jun 25, 2026 - 15:22 vuln.today

Analysis Generated

Jun 25, 2026 - 15:22 vuln.today

DescriptionCVE.org

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could crash the process. This vulnerability is fixed in 1.19.4.

AnalysisAI

Null pointer dereference in Nokogiri prior to 1.19.4 crashes the Ruby process when application code incorrectly calls .allocate directly on a native-backed class inheriting from Nokogiri::XML::Node and then invokes methods on the resulting uninitialized object. Only CRuby is affected - JRuby is explicitly not vulnerable. No public exploit has been identified; the CVSS 4.0 base score of 1.7 with E:U accurately reflects that this defect requires a developer programming error rather than any crafted external input, placing it firmly in the low-priority category.

Technical ContextAI

Nokogiri (CPE: cpe:2.3:a:sparklemotion:nokogiri:*:*:*:*:*:*:*:*) is a widely used Ruby gem that wraps libxml2 and libxslt for XML and HTML parsing via a native C extension. Its object lifecycle assumes that all instances are created through documented constructors and factory methods, which properly initialize the underlying C data pointer. Ruby's built-in .allocate method bypasses this initialization, producing an object whose native pointer is NULL. When any Nokogiri method subsequently dereferences that pointer, the process crashes - a classic CWE-476 (NULL Pointer Dereference) defect. Nokogiri 1.19.4 introduces explicit NULL-pointer guards at the method entry points that raise a Ruby RuntimeError before the unsafe dereference occurs, converting a silent crash into a catchable exception.

RemediationAI

Vendor-released patch: 1.19.4. Upgrade Nokogiri to version 1.19.4 or later using gem update nokogiri or, in Bundler-managed projects, by updating the version constraint in Gemfile and running bundle update nokogiri. The fix is confirmed in GitHub Security Advisory GHSA-9cv2-cfxc-v4v2 at https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-9cv2-cfxc-v4v2. As a code-level workaround that eliminates the condition entirely without upgrading, audit all application code for direct calls to .allocate on any Nokogiri class (e.g., Nokogiri::XML::Node.allocate, Nokogiri::XML::Document.allocate) and replace them with documented constructors and factory methods such as Nokogiri::XML::Document.new or Nokogiri::HTML5::Document.parse. This workaround carries no functional trade-offs because direct .allocate usage on native-backed Nokogiri classes is an undocumented and unsupported pattern.