---
id: "CVE-2026-126064"
page: "https://infrastack.ai/live/CVE-2026-126064"
kind: "vulnerability"
aliases: ["CVE-2026-126064", "GHSA-3w22-6jfg-527w"]
title: "Nokogiri: Use-After-Free in Nokogiri when replacing an attribute value"
severity: "low"
cvss: 2.0
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "nokogiri", "fixed": ["1.19.5"], "affected": "< 1.19.5", "ecosystem": "rubygems"}]
ecosystems: ["rubygems"]
tags: ["cwe-416", "nokogiri", "package", "ruby", "rubygems"]
not_affected_if: ["default-usage-pattern", "jruby", "nokogiri-1.19.5-or-later"]
published_at: "2026-11-10T20:51:19+00:00"
first_seen_at: "2026-11-10T20:51:58+00:00"
updated_at: "2026-11-10T21:46:15+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-3w22-6jfg-527w", "first_seen_at": "2026-11-10T20:51:58+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126064", "first_seen_at": "2026-11-10T21:46:15+00:00"}]
exploit_sources: []
---

# Nokogiri: Use-After-Free in Nokogiri when replacing an attribute value

Link for people: https://infrastack.ai/live/CVE-2026-126064 (this .md is for agents)

Nokogiri's native extension can leave a Ruby object pointing at freed memory when an XML attribute's value is replaced after its child nodes were accessed. Using such a stale node can cause an invalid read and a possible crash (segfault).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- rubygems:nokogiri affected < 1.19.5 fixed 1.19.5

## How to check

- Check the Nokogiri version in the project lockfile (`Gemfile.lock`) or with `bundle exec gem list nokogiri`
- Look for code that reads `Attr#children` on an attribute and then calls `Node#[]=` or `Node#lang=` on that same attribute
- JRuby is not affected

## Fix

- Nokogiri: upgrade to `1.19.5` or later
- Workaround from the advisory: avoid accessing attribute child nodes directly before replacing the same attribute's value

## Timeline

- 2026-11-10T20:51:58+00:00 ghsa https://github.com/advisories/GHSA-3w22-6jfg-527w
- 2026-11-10T21:46:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126064

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/sparklemotion/nokogiri/security-advisories/GHSA-3w22-6jfg-527w
- [advisory] Maintainer's advisory: github.com https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-3w22-6jfg-527w
- [fix] Patch: github.com https://github.com/sparklemotion/nokogiri/pull/3752
- [fix] Patch: github.com https://github.com/sparklemotion/nokogiri/commit/b15b518db9fd15fd6b046f73d1439c282e5cc425
- [fix] Patch: github.com https://github.com/sparklemotion/nokogiri/commit/feaed3c8c9bd9d81d064d4ca09b16044cd705d6f
- [fix] Release notes: github.com https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5

## From the sources

### Summary

Nokogiri's CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an existing XML attribute via `Nokogiri::XML::Node#[]=` or `Nokogiri::XML::Node#lang=`. If Ruby code had already accessed the attribute's child nodes, replacing the value could free those native child nodes while their wrappers remained reachable. Using one of those child nodes afterwards could cause an invalid read and a possible segfault.

This is the same class of issue as [GHSA-phwj-rprq-35pp](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-phwj-rprq-35pp), which was fixed for `Attr#value=` in Nokogiri 1.19.4.

Nokogiri 1.19.5 preserves all already-wrapped attribute child nodes before replacing the attribute value.

JRuby is not affected.

### Severity

The Nokogiri maintainers have evaluated this as low severity. Reaching it requires an unusual API-usage pattern that does not arise during normal use. The application must directly access an attribute's child nodes and then replace that same attribute's value via `Node#[]=` or `Node#lang=`. Nokogiri 1.19.5 makes this pattern safe with no change to the public API.

### Mitigation

Upgrade to Nokogiri 1.19.5 or later.

As a workaround, avoid accessing attribute child nodes directly via `Attr#children` or similar before replacing the same attribute's value.

### Credit

This issue was responsibly reported by zx (@manus-pi).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_