NOKOGIRI · CVE-2026-126064 · Package
FIX → 1.19.5
Nokogiri's native extension can leave a Ruby object pointing at freed memory when an XML attribute's value is replaced after its child nodes were accessed. Using such a stale node can cause an invalid read and a possible crash (segfault).
first public Nov 2, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications running CRuby with Nokogiri below 1.19.5 that read an attribute's child nodes and then replace that same attribute's value through Node#[]= or Node#lang=. The advisory says this pattern does not arise in normal use, and JRuby is not affected.
Not affected if default-usage-pattern, jruby, nokogiri-1.19.5-or-later
Who cares nokogiri, ruby, rubygems
Gemfile.lock) or with bundle exec gem list nokogiriAttr#children on an attribute and then calls Node#[]= or Node#lang= on that same attributeUpgrade to 1.19.5
Nokogiri's CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an existing XML attribute via Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang=. If Ruby code had already accessed the attribute's child nodes, replacing the value could free those native child nodes while their wrappers remained reachable. Using one of those child nodes afterwards could cause an invalid read and a possible segfault.
This is the same class of issue as GHSA-phwj-rprq-35pp, which was fixed for Attr#value= in Nokogiri 1.19.4.
Nokogiri 1.19.5 preserves all already-wrapped attribute child nodes before replacing the attribute value.
JRuby is not affected.
The Nokogiri maintainers have evaluated this as low severity. Reaching it requires an unusual API-usage pattern that does not arise during normal use. The application must directly access an attribute's child nodes and then replace that same attribute's value via Node#[]= or Node#lang=. Nokogiri 1.19.5 makes this pattern safe with no change to the public API.
Upgrade to Nokogiri 1.19.5 or later.
As a workaround, avoid accessing attribute child nodes directly via or similar before replacing the same attribute's value.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
1.19.5 or laterAttr#childrenThis issue was responsibly reported by zx (@manus-pi).
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.