sparklemotion nokogiri up to 1.19.3 Garbage Collection XPathContext use after free

Summaryinfo

A vulnerability, which was classified as critical, has been found in sparklemotion nokogiri up to 1.19.3. This impacts the function Nokogiri::XML::XPathContext of the component Garbage Collection Handler. Performing a manipulation results in use after free. This vulnerability is cataloged as CVE-2026-57437. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in sparklemotion nokogiri up to 1.19.3. This affects the function Nokogiri::XML::XPathContext of the component Garbage Collection Handler. The manipulation with an unknown input leads to a use after free vulnerability. CWE is classifying the issue as CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. This is going to have an impact on availability. The summary by CVE is:

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::XPathContext did not keep its source document alive for garbage collection. If an XPathContext outlived its document and the document was collected, evaluating an XPath expression could read invalid memory and potentially segfault. This is only reachable when application code constructs an XPathContext directly and lets the document become unreachable while continuing to use the context. The normal Document#xpath, #css, and related search methods are not affected, and it is not triggerable by malicious document input. This vulnerability is fixed in 1.19.4.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-57437 since 06/24/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 323620 (Linux Distros Unpatched Vulnerability : CVE-2026-57437), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.19.4 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (323620) and EUVD (EUVD-2026-39428). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• sparklemotion

Name

• nokogiri

Version

• 1.19.0
• 1.19.1
• 1.19.2
• 1.19.3

Website

• Product: https://github.com/sparklemotion/nokogiri/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion