CVE-2026-57436: Nokogiri

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::Document#root= validated only that the new root was a Nokogiri::XML::Node, allowing a DTD node to be set as the document root. The result is a heap use-after-free during garbage collection or finalization, leading to an invalid memory read or potentially a segfault. This vulnerability is fixed in 1.19.4.

Affected products

• Nokogiri Nokogiri: before 1.19.4 (fixed in 1.19.4)

Published 2026-06-25. Last modified 2026-06-26.