CVE-2026-57436
Description
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::Document#root= validated only that the new root was a Nokogiri::XML::Node, allowing a DTD node to be set as the document root. The result is a heap use-after-free during garbage collection or finalization, leading to an invalid memory read or potentially a segfault. This vulnerability is fixed in 1.19.4.
Summary dbcve.org
In Nokogiri versions prior to 1.19.4, the Document#root= setter only validated that the assigned node was a Nokogiri::XML::Node but failed to exclude DTD (Document Type Definition) nodes. When a DTD node is set as the document root, garbage collection or finalization triggers a heap use-after-free vulnerability, causing invalid memory reads or potential segfaults.
Mitigation
Upgrade Nokogiri to version 1.19.4 or later to receive the patch that adds proper node type validation to reject DTD nodes as document roots. Test thoroughly after upgrading to ensure compatibility with existing XML processing workflows.