Nokogiri CVE-2026-57434

Exploitation requires application source code to explicitly call Ruby's .allocate method on a Nokogiri class that inherits from Nokogiri::XML::Node and then invoke any method on the resulting uninitialized instance. This is a programming error that violates Nokogiri's documented API contract - it cannot be triggered through normal library use, by parsing untrusted XML or HTML documents, or by any network-delivered or user-supplied input. JRuby deployments are entirely unaffected regardless of code patterns. Exploitation is therefore bounded to CRuby applications containing the specific anti-pattern of direct .allocate usage, which is an uncommon and unsupported usage pattern absent from standard Nokogiri documentation.

Real-world risk is very low across all available signals. The CVSS 4.0 base score of 1.7 with E:U (unexploited evidence) and AT:P (attack requirements present) correctly encodes that exploitation is conditioned on a non-standard, undocumented code pattern. The vendor advisory explicitly confirms that untrusted external input - including malformed documents or malicious file uploads - cannot trigger this flaw; only application code that directly calls .allocate on a Nokogiri native class reaches the vulnerable path. Availability impact is limited to VA:L, meaning a single process crash rather than a system-wide outage. No EPSS data was supplied, but given the narrow exploitation conditions, real-world probability would be negligible. There is no CISA KEV listing and no public exploit code. This vulnerability represents a library hardening fix of interest during routine upgrade cycles, not an emergency requiring out-of-band patching.

A Ruby application contains a code path where a developer has mistakenly called .allocate on a Nokogiri native-backed class - for instance, Nokogiri::XML::Node.allocate - and subsequently invokes a standard Nokogiri method on the resulting uninitialized object. This dereferences a NULL C pointer in the native extension, crashing the Ruby process and causing a denial of service for that application instance. No public exploit code exists, and no external attacker-controlled input is required to reach this path.