{"id":"CVE-2026-126064","kind":"vulnerability","aliases":["CVE-2026-126064","GHSA-3w22-6jfg-527w"],"related":[],"title":"Nokogiri: Use-After-Free in Nokogiri when replacing an attribute value","description":"### Summary\n\nNokogiri's CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an existing XML attribute via `Nokogiri::XML::Node#[]=` or `Nokogiri::XML::Node#lang=`. If Ruby code had already accessed the attribute's child nodes, replacing the value could free those native child nodes while their wrappers remained reachable. Using one of those child nodes afterwards could cause an invalid read and a possible segfault.\n\nThis is the same class of issue as [GHSA-phwj-rprq-35pp](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-phwj-rprq-35pp), which was fixed for `Attr#value=` in Nokogiri 1.19.4.\n\nNokogiri 1.19.5 preserves all already-wrapped attribute child nodes before replacing the attribute value.\n\nJRuby is not affected.\n\n### Severity\n\nThe Nokogiri maintainers have evaluated this as low severity. Reaching it requires an unusual API-usage pattern that does not arise during normal use. The application must directly access an attribute's child nodes and then replace that same attribute's value via `Node#[]=` or `Node#lang=`. Nokogiri 1.19.5 makes this pattern safe with no change to the public API.\n\n### Mitigation\n\nUpgrade to Nokogiri 1.19.5 or later.\n\nAs a workaround, avoid accessing attribute child nodes directly via `Attr#children` or similar before replacing the same attribute's value.\n\n### Credit\n\nThis issue was responsibly reported by zx (@manus-pi).","summary":"Nokogiri's native extension can leave a Ruby object pointing at freed memory when an XML attribute's value is replaced after its child nodes were accessed. Using such a stale node can cause an invalid read and a possible crash (segfault).","severity":"low","cvss":2.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"nokogiri","fixed":["1.19.5"],"affected":"< 1.19.5","ecosystem":"rubygems"}],"ecosystems":["rubygems"],"tags":["cwe-416","nokogiri","package","ruby","rubygems"],"not_affected_if":["default-usage-pattern","jruby","nokogiri-1.19.5-or-later"],"how_to_check":"- Check the Nokogiri version in the project lockfile (`Gemfile.lock`) or with `bundle exec gem list nokogiri`\n- Look for code that reads `Attr#children` on an attribute and then calls `Node#[]=` or `Node#lang=` on that same attribute\n- JRuby is not affected","fix":"- Nokogiri: upgrade to `1.19.5` or later\n- Workaround from the advisory: avoid accessing attribute child nodes directly before replacing the same attribute's value","status":"open","published_at":"2026-11-10T20:51:19+00:00","first_seen_at":"2026-11-10T20:51:58+00:00","triaged_at":"2026-11-10T20:53:39+00:00","updated_at":"2026-11-10T21:46:15+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-10T20:53:39Z","model":"claude-haiku-5-5","output":{"fix":"- Nokogiri: upgrade to `1.19.5` or later\n- Workaround from the advisory: avoid accessing attribute child nodes directly before replacing the same attribute's value","reach":"unknown","title":"Nokogiri: use-after-free when replacing an XML attribute value","impact":"low","summary":"Nokogiri's native extension can leave a Ruby object pointing at freed memory when an XML attribute's value is replaced after its child nodes were accessed. Using such a stale node can cause an invalid read and a possible crash (segfault).","audience":"developers","category":"package","nicknames":[],"who_cares":["ruby","nokogiri","rubygems"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"invalid memory read causes a crash, possibly more","analyst_note":"","how_to_check":"- Check the Nokogiri version in the project lockfile (`Gemfile.lock`) or with `bundle exec gem list nokogiri`\n- Look for code that reads `Attr#children` on an attribute and then calls `Node#[]=` or `Node#lang=` on that same attribute\n- JRuby is not affected","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["jruby","default-usage-pattern","nokogiri-1.19.5-or-later"],"who_is_affected":"Applications running CRuby with Nokogiri below 1.19.5 that read an attribute's child nodes and then replace that same attribute's value through Node#[]= or Node#lang=. The advisory says this pattern does not arise in normal use, and JRuby is not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000811,"input_tokens":5125,"output_tokens":596,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-126064':15A,23A '-2026':14A,22A '-416':26B '/sparklemotion/nokogiri/security/advisories/ghsa-phwj-rprq-35pp),':162C '1.19.4':171C '1.19.5':173C,241C,257C '35pp':159C '3w22':18A '527w':20A '6jfg':19A 'access':57B,111C,221C,264C 'affect':190C 'afterward':137C 'alreadi':110C,177C 'already-wrap':176C 'api':207C,252C 'api-usag':206C 'applic':218C 'aris':213C 'attr':167C,270C 'attribut':11A,47B,96C,113C,179C,185C,223C,232C,265C,278C 'avoid':263C 'caus':64B,139C 'chang':248C 'child':54B,115C,124C,135C,180C,225C,266C 'children':271C 'class':151C 'code':108C 'could':79C,120C,138C 'crash':71B 'credit':281C 'crubi':76C 'cve':13A,21A 'cwe':25B 'direct':220C,268C 'evalu':196C 'exist':94C 'extens':34B,78C 'fix':165C 'free':5A,121C 'freed':42B,86C 'ghsa':17A,156C 'ghsa-3w22-6jfg-527w':16A 'ghsa-phwj-rprq-35pp':155C 'github.com':161C 'github.com/sparklemotion/nokogiri/security/advisories/ghsa-phwj-rprq-35pp),':160C 'invalid':66B,141C 'issu':153C,283C 'jrubi':187C 'lang':105C,239C 'later':259C 'leav':36B,80C 'low':199C 'maintain':194C 'make':242C 'manus':290C 'manus-pi':289C 'memori':43B,87C 'mitig':253C 'must':219C 'nativ':33B,77C,123C 'node':55B,62B,100C,104C,116C,125C,136C,181C,226C,236C,238C,267C 'nokogiri':1A,7A,24A,27B,31B,74C,98C,102C,170C,172C,193C,240C,256C 'normal':215C 'object':39B 'one':132C 'packag':28B 'pattern':209C,244C 'phwj':157C 'pi':291C 'point':40B,84C 'possibl':70B,145C 'preserv':174C 'public':251C 'reach':201C 'reachabl':130C 'read':67B,142C 'remain':129C 'replac':9A,51B,89C,117C,183C,229C,275C 'report':286C 'requir':203C 'respons':285C 'rprq':158C 'rubi':29B,38B,82C,107C 'rubygem':30B 'safe':245C 'segfault':72B,146C 'sever':191C,200C 'similar':273C 'stale':61B 'summari':73C 'unusu':205C 'upgrad':254C 'usag':208C 'use':3A,58B,131C,216C 'use-after-fre':2A 'valu':12A,49B,91C,119C,168C,186C,234C,280C 'via':97C,235C,269C 'workaround':262C 'wrap':178C 'wrapper':83C,128C 'xml':46B,95C,99C,103C 'zx':288C","nicknames":[],"mitigations":[],"who_affected":"Applications running CRuby with Nokogiri below 1.19.5 that read an attribute's child nodes and then replace that same attribute's value through Node#[]= or Node#lang=. The advisory says this pattern does not arise in normal use, and JRuby is not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["nokogiri"],"ptokens":["nokogiri"],"labels":["cwe416","low","nokogiri","package","ruby","rubygems"],"campaign_type":null,"search_a":"'-126064':15A,23A '-2026':14A,22A '3w22':18A '527w':20A '6jfg':19A 'attribut':11A 'cve':13A,21A 'free':5A 'ghsa':17A 'ghsa-3w22-6jfg-527w':16A 'nokogiri':1A,7A,24A 'replac':9A 'use':3A 'use-after-fre':2A 'valu':12A","search_b":"'-416':26B 'access':57B 'attribut':47B 'caus':64B 'child':54B 'crash':71B 'cwe':25B 'extens':34B 'freed':42B 'invalid':66B 'leav':36B 'memori':43B 'nativ':33B 'node':55B,62B 'nokogiri':27B,31B 'object':39B 'packag':28B 'point':40B 'possibl':70B 'read':67B 'replac':51B 'rubi':29B,38B 'rubygem':30B 'segfault':72B 'stale':61B 'use':58B 'valu':49B 'xml':46B","search_c":"'/sparklemotion/nokogiri/security/advisories/ghsa-phwj-rprq-35pp),':162C '1.19.4':171C '1.19.5':173C,241C,257C '35pp':159C 'access':111C,221C,264C 'affect':190C 'afterward':137C 'alreadi':110C,177C 'already-wrap':176C 'api':207C,252C 'api-usag':206C 'applic':218C 'aris':213C 'attr':167C,270C 'attribut':96C,113C,179C,185C,223C,232C,265C,278C 'avoid':263C 'caus':139C 'chang':248C 'child':115C,124C,135C,180C,225C,266C 'children':271C 'class':151C 'code':108C 'could':79C,120C,138C 'credit':281C 'crubi':76C 'direct':220C,268C 'evalu':196C 'exist':94C 'extens':78C 'fix':165C 'free':121C 'freed':86C 'ghsa':156C 'ghsa-phwj-rprq-35pp':155C 'github.com':161C 'github.com/sparklemotion/nokogiri/security/advisories/ghsa-phwj-rprq-35pp),':160C 'invalid':141C 'issu':153C,283C 'jrubi':187C 'lang':105C,239C 'later':259C 'leav':80C 'low':199C 'maintain':194C 'make':242C 'manus':290C 'manus-pi':289C 'memori':87C 'mitig':253C 'must':219C 'nativ':77C,123C 'node':100C,104C,116C,125C,136C,181C,226C,236C,238C,267C 'nokogiri':74C,98C,102C,170C,172C,193C,240C,256C 'normal':215C 'one':132C 'pattern':209C,244C 'phwj':157C 'pi':291C 'point':84C 'possibl':145C 'preserv':174C 'public':251C 'reach':201C 'reachabl':130C 'read':142C 'remain':129C 'replac':89C,117C,183C,229C,275C 'report':286C 'requir':203C 'respons':285C 'rprq':158C 'rubi':82C,107C 'safe':245C 'segfault':146C 'sever':191C,200C 'similar':273C 'summari':73C 'unusu':205C 'upgrad':254C 'usag':208C 'use':131C,216C 'valu':91C,119C,168C,186C,234C,280C 'via':97C,235C,269C 'workaround':262C 'wrap':178C 'wrapper':83C,128C 'xml':95C,99C,103C 'zx':288C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-02T03:45:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-3w22-6jfg-527w","url":"https://github.com/advisories/GHSA-3w22-6jfg-527w","severity":"low","published_at":"2026-11-10T20:51:19+00:00","modified_at":"2026-11-10T20:51:29+00:00","first_seen_at":"2026-11-10T20:51:58+00:00","fetched_at":"2026-11-10T21:16:10+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-126064","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126064","severity":null,"published_at":"2026-11-10T21:19:24+00:00","modified_at":"2026-11-10T21:19:24+00:00","first_seen_at":"2026-11-10T21:46:15+00:00","fetched_at":"2026-11-10T21:46:16+00:00","note":null}],"documents":[{"id":118300,"url":"https://api.github.com/repos/sparklemotion/nokogiri/security-advisories/GHSA-3w22-6jfg-527w","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":118301,"url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-3w22-6jfg-527w","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-11-02T03:45:36+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":118302,"url":"https://github.com/sparklemotion/nokogiri/pull/3752","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":118303,"url":"https://github.com/sparklemotion/nokogiri/commit/b15b518db9fd15fd6b046f73d1439c282e5cc425","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":118304,"url":"https://github.com/sparklemotion/nokogiri/commit/feaed3c8c9bd9d81d064d4ca09b16044cd705d6f","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":118162,"url":"https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}