CVE-2026-79769 in Nokogiri
Summary
by MITRE • 08/25/2026
Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protected internal Node#initialize_copy_with_args helper behind Node#dup and #clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a non-Node argument (e.g., a Namespace), it reads an xmlNs out of bounds, crashing the process. This is only triggerable by a programming error and cannot be triggered by untrusted input or normal use of the public API. Only CRuby is affected. Version 1.19.4 adds a type check and raises TypeError.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified in Nokogiri versions prior to 1.19.4 represents an invalid out-of-bounds memory read within the Ruby C extension layer of the library. This flaw is located specifically in the protected internal helper method Node#initialize_copy_with_args, which serves as a backend implementation for the public duplication and cloning methods Node#dup and #clone. The core technical deficiency lies in the lack of rigorous type checking when unwrapping source arguments from Ruby objects into their corresponding C structures. Specifically, the function assumes that any argument passed to it is an xmlNode structure but fails to verify this assumption before proceeding with memory access operations.
When application code invokes these duplication methods on a Nokogiri Node object while passing a non-Node argument such as an XML Namespace (xmlNs) or other incompatible types, the internal logic attempts to interpret the data pointer of that invalid type as if it were an xmlNode structure. Because the memory layout and size requirements for an xmlNs differ significantly from those of an xmlNode, this misinterpretation leads to reading memory addresses outside the bounds of the allocated object. This out-of-bounds read results in immediate process termination or a segmentation fault due to accessing invalid virtual memory pages.
From a security impact perspective, it is critical to distinguish between external exploitation and internal programming errors. The vulnerability cannot be triggered by untrusted input processed through normal public API usage because standard operations do not involve manually passing arbitrary Ruby objects into the protected initialization helper. Instead, this flaw is exclusively triggerable by developer mistakes where application code incorrectly utilizes the library's internals or passes incompatible types to methods that expect specific Node instances. Consequently, while the immediate effect is a denial of service through process crash rather than remote code execution, it highlights a lack of defensive programming practices within the extension layer regarding type safety and boundary checks.
This issue aligns with CWE-125, which describes out-of-bounds read vulnerabilities where software reads data past the end or before the beginning of the intended buffer. In terms of attack vector classification under MITRE ATT&CK, this would fall under execution flaws related to improper input validation within native code components, although its practical exploitability is limited by the requirement for direct API misuse rather than external payload injection. The vulnerability affects only CRuby implementations due to specific memory management and object model differences in that runtime environment compared to other Ruby variants like JRuby or TruffleRuby.
The remediation strategy implemented in version 1.19.4 involves adding explicit type checking within the Node#initialize_copy_with_args function before attempting to unwrap the source argument. By verifying that the passed object is indeed a valid Nokogiri::XML::Node instance, the library prevents the unsafe memory access from occurring. If an incompatible type such as a Namespace is detected, the method now raises a TypeError exception instead of proceeding with the invalid cast and subsequent out-of-bounds read. This change enforces stricter contract adherence at the API boundary, ensuring that only valid node types are processed during duplication operations. Organizations relying on affected versions should upgrade to Nokogiri 1.19.4 or later immediately to eliminate this crash vector and ensure robust handling of object type mismatches in their XML processing workflows.