EUVD-2026-39428Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear
AC:H captures the non-default direct-XPathContext API misuse and GC timing required; only low availability impact applies via potential segfault.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::XPathContext did not keep its source document alive for garbage collection. If an XPathContext outlived its document and the document was collected, evaluating an XPath expression could read invalid memory and potentially segfault. This is only reachable when application code constructs an XPathContext directly and lets the document become unreachable while continuing to use the context. The normal Document#xpath, #css, and related search methods are not affected, and it is not triggerable by malicious document input. This vulnerability is fixed in 1.19.4.
AnalysisAI
Use-after-free in Nokogiri's CRuby implementation (versions prior to 1.19.4) allows an application crash via segfault when an XML::XPathContext object outlives its source document and that document is freed by Ruby's garbage collector. Only CRuby is affected; JRuby is not. This is not triggerable by malicious document input and cannot be reached through the standard Document#xpath, #css, or related methods - it requires an unusual direct API usage pattern in application code. No public exploit has been identified, this is not listed in CISA KEV, and the CVSS 4.0 score of 1.7 reflects the tightly constrained triggering conditions.
Technical ContextAI
Nokogiri is a widely used Ruby gem wrapping libxml2 and libxslt for XML and HTML parsing and XPath querying. CWE-416 (Use After Free) manifests in Nokogiri's C extension layer: Nokogiri::XML::XPathContext wraps libxml2's xmlXPathContextPtr and, prior to 1.19.4, held a raw C pointer to its source document without registering a GC reference. Ruby's mark-and-sweep garbage collector could therefore free the underlying document object while the XPathContext retained a dangling pointer. A subsequent XPath evaluation dereferences that freed memory, producing undefined behavior or a segfault. The fix in 1.19.4 roots the source document against GC for the full lifetime of the XPathContext. JRuby is unaffected because its XML implementation does not share this C-extension memory management model. Affected CPE: cpe:2.3:a:sparklemotion:nokogiri:*:*:*:*:*:*:*:*.
RemediationAI
Vendor-released patch: 1.19.4. Upgrade the nokogiri gem to version 1.19.4 or later, which causes XPathContext to hold a GC reference to its source document for the duration of the context's lifetime, eliminating the use-after-free with no breaking changes to the public API. See the advisory at https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-p67v-3w7g-wjg7 for release details. For deployments that cannot immediately upgrade, the effective workaround is to ensure any Ruby variable referencing the source document remains in scope and reachable for the full lifetime of any Nokogiri::XML::XPathContext constructed from it. Applications using only the standard Document#xpath, #css, #search, and related methods require no action, as those methods already maintain the document reference internally and are entirely unaffected.
Nokogiri is an open source XML and HTML library for Ruby. Rated high severity (CVSS 8.2), this vulnerability is remotely
A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Rub
Memory-corruption denial of service (and potential code execution) affects the Ruby Nokogiri gem before 1.18.3, which bu
Denial-of-service in Nokogiri before 1.19.3 stems from three distinct ReDoS vulnerabilities in the CSS selector tokenize
Use-after-free memory corruption in Nokogiri before 1.18.4 exposes Ruby applications to potential heap corruption and pr
Out-of-bounds memory read in Nokogiri (CRuby) versions before 1.19.4 crashes the host Ruby process when application code
Heap-based buffer under-read in libxml2's XML Schema identity constraint processor affects all Nokogiri releases prior t
Nokogiri is an open source XML and HTML library for the Ruby programming language. Rated high severity (CVSS 7.5), this
Nokogiri is an open source XML and HTML library for Ruby. Rated high severity (CVSS 7.5), this vulnerability is remotely
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. Rated high sever
Heap memory leaks in Nokogiri's XSLT transform method (versions before 1.19.3) enable gradual denial of service against
Unchecked return value in Nokogiri's CRuby extension (versions 1.5.1 through 1.19.0) causes the `canonicalize` method to
Same weakness CWE-416 – Use After Free
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today