Is there a patch available for CVE-2026-57436?

Yes, a patch is available for CVE-2026-57436. Update the affected software to the latest version immediately.

Nokogiri CVE-2026-57436

Q: What is the CVSS score of CVE-2026-57436?

CVE-2026-57436 has a CVSS 4.0 base score of 1.7 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-39427 LOW

Use After Free (CWE-416)

2026-06-25 GitHub_M

Information Disclosure Use After Free Memory Corruption Nokogiri Sparklemotion

1.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

1.7 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

1.9 LOW

Requires ability to write and deploy application code with the specific API misuse (PR:H, AV:L, AC:H); only availability impact applies.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L

4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 25, 2026 - 16:03 EUVD

Source Code Evidence Fetched

Jun 25, 2026 - 15:23 vuln.today

Analysis Generated

Jun 25, 2026 - 15:23 vuln.today

DescriptionCVE.org

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::Document#root= validated only that the new root was a Nokogiri::XML::Node, allowing a DTD node to be set as the document root. The result is a heap use-after-free during garbage collection or finalization, leading to an invalid memory read or potentially a segfault. This vulnerability is fixed in 1.19.4.

AnalysisAI

Heap use-after-free in Nokogiri's CRuby implementation (prior to 1.19.4) can corrupt process memory when application code assigns a DTD node as a document root via Document#root=. The root cause is insufficient type validation in the setter, which accepted any Nokogiri::XML::Node subclass rather than restricting to element nodes, leaving libxml2 in an inconsistent internal state that triggers a dangling pointer dereference during Ruby garbage collection or finalization. No active exploitation is confirmed (not in CISA KEV), no public exploit is identified, and the Nokogiri maintainers rate this low severity; the CVSS 4.0 score of 1.7 with E:U corroborates that assessment.

Technical ContextAI

Nokogiri is a Ruby gem that wraps libxml2 (for the CRuby/MRI runtime) and Xerces (for JRuby) to provide XML and HTML parsing. The vulnerability is isolated to the CRuby/libxml2 backend (CPE: cpe:2.3:a:sparklemotion:nokogiri:*:*:*:*:*:*:*:*). The Nokogiri::XML::Document#root= setter validated its argument only as an instance of Nokogiri::XML::Node, a broad base class that includes DTD nodes (Nokogiri::XML::DTD), processing instruction nodes, and others. When a DTD node is assigned as the root, libxml2's internal xmlDoc structure holds a pointer to a node type that is invalid in that slot. During Ruby object finalization or garbage collection, libxml2's cleanup routines dereference or free this node, resulting in a CWE-416 heap use-after-free: the pointer refers to memory that has already been freed, causing an invalid memory read or, in the worst case, a segfault that crashes the Ruby process. The JRuby implementation was not vulnerable because it uses a separate code path, though the same input validation was added there for behavioral parity.

RemediationAI

Upgrade Nokogiri to version 1.19.4 or later; this is the vendor-confirmed patch (GHSA-wjv4-x9w8-wm3h at https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-wjv4-x9w8-wm3h). Version 1.19.4 changes Document#root= to raise TypeError for any non-element node, preventing the invalid libxml2 state from being created. For applications that cannot upgrade immediately, the workaround is to audit all call sites of Document#root= and enforce that only element nodes (Nokogiri::XML::Element) are assigned; passing DTD nodes, comment nodes, processing instruction nodes, or other non-element types must be prevented at the application layer. This workaround requires a code audit and is inherently incomplete if call sites are not fully enumerated, so upgrading to 1.19.4 is strongly preferred. No side effects from the patch have been noted; the TypeError behavior is a stricter, safer contract for a method that previously silently accepted invalid input.