Skip to main content

Nokogiri CVE-2026-79769

| EUVDEUVD-2026-65527 HIGH
Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)
2026-08-25 VulnCheck GHSA-58vh-2xxg-v7j2
Denial Of Service Memory Corruption Nokogiri Sparklemotion
8.7
CVSS 4.0 · Vendor: VulnCheck
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Developer writes code passing non-Node object to Node#dup/clone
  2. Exploit
    Protected helper unwraps argument as xmlNode without type check
  3. Execution
    xmlNs struct read out of bounds in C extension
  4. Impact
    Ruby process terminates with segfault

Vulnerability Assessment

Weakness
CWE
CWE-843
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires application source code to contain a programming error: specifically, a call - direct or indirect via Node#dup or #clone - to the protected method Node#initialize_copy_with_args with a non-Node Nokogiri object (e.g., a Namespace) as the argument. The vendor explicitly states this 'cannot be triggered by untrusted input or normal use of the public API,' meaning no network attacker, uploaded file, or parsed document can reach this code path through Nokogiri's public surface. Only the CRuby runtime is affected; JRuby users are not exposed regardless of version. Limiting factors: requires developer-authored coding error in application code; not reachable via external or user-supplied input; not exploitable in applications correctly using Nokogiri's public API; not exploitable on JRuby.
Impact

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) yields a score of 8.7 but materially conflicts with the vendor's own description, which states the flaw 'cannot be triggered by untrusted input or normal use of the public API' and is 'only triggerable by a programming error.' A vector of AV:N/PR:N implies any remote unauthenticated attacker can crash the process, which is factually incorrect per the advisory. A more accurate assessment places the attack vector at AV:L with PR:H, reflecting that only a developer-introduced coding mistake - passing a wrong object type to a protected internal method - can cause the crash. No EPSS score is available in the provided data. The vulnerability is not listed in the CISA KEV catalog, and no public exploit or POC code has been identified. Net real-world risk is low: the impact is limited to an availability crash in applications with a specific developer coding error, not a remotely exploitable denial-of-service condition. Patch urgency is low-to-moderate - upgrade at next release cycle rather than emergency patch.
Exploit ScenarioDerived

A Ruby application using Nokogiri before 1.19.4 on CRuby contains a developer coding error where a Nokogiri Namespace object (rather than a Node) is inadvertently passed to Node#dup or Node#clone, routing through the unguarded initialize_copy_with_args helper. The C extension misinterprets the xmlNs memory layout as xmlNode, reads out of bounds, and the Ruby process crashes with a segmentation fault. This scenario requires an error in the application's own source code and cannot be triggered via crafted HTTP requests, file uploads, or any other form of external attacker-controlled input.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 25, 2026

Out-of-bounds memory read in Nokogiri (CRuby) versions before 1.19.4 crashes the host Ruby process when application code incorrectly passes a non-Node argument to the protected internal Node#initialize_copy_with_args method. The method backs the public Node#dup and #clone APIs and, prior to 1.19.4, unwraps its argument directly as a libxml2 xmlNode struct without verifying the object's type, causing it to misread an xmlNs (Namespace) struct out of bounds. Critically, the vendor explicitly confirms this cannot be triggered by untrusted external input - only by a programming error in application code - making the provided CVSS 4.0 score of 8.7 (AV:N/PR:N) a significant overstatement of real-world risk. No public exploit has been identified at time of analysis.

RemediationAI

Upgrade to Nokogiri 1.19.4 or later; this release introduces an explicit type check in Node#initialize_copy_with_args and raises a TypeError on mismatched input instead of performing the out-of-bounds read, as confirmed by the vendor advisory GHSA-g9g8-vgvw-g3vf. If an immediate upgrade is not feasible, audit application code to ensure no call site passes a Namespace or other non-Node Nokogiri object to Node#dup, Node#clone, or directly to the protected initialize_copy_with_args method; since the issue is reachable only through a developer coding error and not external input, runtime input validation provides no protection. There are no network-layer or WAF-based compensating controls applicable to this vulnerability.

Affected VersionsENISA

nokogiri 0 <1.19.4

Affected Packages

euvd nokogiri fix: 1.19.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Nokogiri is a widely-used Ruby gem that wraps libxml2 (and libgumbo) to provide HTML/XML parsing and manipulation for CRuby and JRuby applications. The vulnerable code path resides in the C extension layer: the protected internal helper Node#initialize_copy_with_args, which is called internally by Node#dup and Node#clone, casts its source argument directly to an xmlNode C struct pointer without first asserting the Ruby object is actually a Nokogiri Node. When a caller mistakenly supplies a Namespace object (internally backed by an xmlNs struct), the type confusion (CWE-843) causes the method to interpret xmlNs memory as xmlNode layout, reading fields out of bounds and triggering a process-level segmentation fault. The CPE cpe:2.3:a:sparklemotion:nokogiri:*:*:*:*:*:*:*:* covers all pre-1.19.4 CRuby releases. The JRuby variant is explicitly unaffected because it does not share this C extension code path.

Know when Nokogiri gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
vuln.today AI 4.4 MEDIUM

Vendor confirms trigger requires developer coding error in application source; no remote or untrusted-input vector is possible, so AV:L and PR:H apply with availability-only impact.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 4.4 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

2
Patch available
Aug 25, 2026 - 17:17 EUVD
CVE Published
Aug 25, 2026 - 15:16 cve.org
HIGH 8.7

DescriptionCVE.org

Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protected internal Node#initialize_copy_with_args helper behind Node#dup and #clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a non-Node argument (e.g., a Namespace), it reads an xmlNs out of bounds, crashing the process. This is only triggerable by a programming error and cannot be triggered by untrusted input or normal use of the public API. Only CRuby is affected. Version 1.19.4 adds a type check and raises TypeError.

Executive ViewAI

Why It Matters

Nokogiri, a widely-used Ruby XML parsing library, contains an out-of-bounds memory read vulnerability (CVE-2026-79769) that can crash affected application processes, causing potential service disruptions. Critically, this vulnerability requires a programming error within application code to manifest and cannot be exploited through untrusted external input or network attacks. While published as CVSS 8.7, the vendor explicitly confirms the real-world organizational risk is significantly lower due to the internal-only attack vector.

Business Impact: Medium
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: enforce mandatory code review for Nokogiri API calls to prevent unsafe patterns, pin Nokogiri versions in dependency management to prevent accidental upgrades to vulnerable versions, and ensure development teams understand this vulnerability requires internal code errors to manifest-not external input. Apply vendor patch to Nokogiri 1.19.4 or later immediately upon availability.

Threat Intelligence Overview

EPSS Score
0.2%
Top 92% exploitable
Prevalence
High
widely-used Ruby gem, core dependency across Rails and Ruby web ecosystem
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
Medium
Technical Impact
Partial

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Nokogiri

View all
CVE-2022-29181 HIGH POC
8.2 May 20

Nokogiri is an open source XML and HTML library for Ruby. Rated high severity (CVSS 8.2), this vulnerability is remotely
CVE-2019-5477 CRITICAL
9.8 Aug 16

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Rub
CVE-2026-79770 HIGH
8.7 Aug 25

Denial-of-service in Nokogiri before 1.19.3 stems from three distinct ReDoS vulnerabilities in the CSS selector tokenize
CVE-2025-71346 HIGH
8.7 Aug 25

Heap-based buffer under-read in libxml2's XML Schema identity constraint processor affects all Nokogiri releases prior t
CVE-2022-23476 HIGH
7.5 Dec 08

Nokogiri is an open source XML and HTML library for the Ruby programming language. Rated high severity (CVSS 7.5), this

CVE-2022-24836 HIGH
7.5 Apr 11

Nokogiri is an open source XML and HTML library for Ruby. Rated high severity (CVSS 7.5), this vulnerability is remotely
CVE-2021-41098 HIGH
7.5 Sep 27

Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. Rated high sever
CVE-2026-79771 MEDIUM
6.9 Aug 25

Heap memory leaks in Nokogiri's XSLT transform method (versions before 1.19.3) enable gradual denial of service against

CVE-2026-79772 MEDIUM
6.9 Aug 25

Unchecked return value in Nokogiri's CRuby extension (versions 1.5.1 through 1.19.0) causes the `canonicalize` method to
CVE-2026-57235 MEDIUM
6.3 Jun 25

Out-of-bounds read in Nokogiri's `NodeSet#[]` method (all versions before 1.19.4) enables an attacker who can supply a l
CVE-2020-26247 MEDIUM
4.3 Dec 30

Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. Rated medium sev
CVE-2026-57234 LOW
2.6 Jun 25

NONET network restriction bypass in Nokogiri's JRuby implementation permits external resource fetching during XML Schema

Same weakness CWE-843 – Access of Resource Using Incompatible Type (Type Confusion)

View all
CVE-2011-0611 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2017-8291 HIGH POC
7.8
CVE-2016-7201 HIGH POC
8.8
CVE-2017-0037 HIGH POC
8.1
CVE-2019-0752 HIGH POC
7.5
CVE-2017-5070 HIGH POC
8.8
CVE-2023-3079 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

References

Advisories & patches
ADVISORY https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-g9g8-vgvw-g3vf ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-79769 REF https://www.vulncheck.com/advisories/nokogiri-before-invalid-memory-read-via-initialize-copy-with-args

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy