CVE-2026-79769: Nokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_args
Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protected internal Node#initializecopywithargs helper behind Node#dup and #clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a non-Node argument (e.g., a Namespace), it reads an xmlNs out of bounds, crashing the process. This is only triggerable by a programming error and cannot be triggered by untrusted input or normal use of the public API. Only CRuby is affected. Version 1.19.4 adds a type check and raises TypeError.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nokogirito a version that resolves this vulnerability.Fixed in 1.19.4
Event History
Frequently Asked Questions
Which deployments are actually exposed to this issue?
Only applications using Nokogiri on CRuby are affected. The issue requires application code to call the protected internal Node#initialize_copy_with_args helper, directly or through an improper use of Node#dup or #clone, with a non-Node object such as a Namespace.
Can an external attacker trigger this through crafted input?
No. The issue is only triggerable by a programming error and cannot be triggered by untrusted input or normal use of Nokogiri's public API.
What happens when the vulnerable code path is reached?
Nokogiri may perform an out-of-bounds read by treating a non-Node argument as an xmlNode. This can crash the Ruby process, causing a denial of service.
How is the issue handled in the fixed release?
Nokogiri 1.19.4 adds a type check to the internal helper. Passing a non-Node argument causes a TypeError instead of an invalid memory read.