CVE-2026-57437

RubyGems/nokogiri CVE-2026-57437: low, EPSS 0.40%

Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime

Action: Upgrade nokogiri to 1.19.4 or later.

bundle update nokogiri

Affected

Fixed versions

Sources

• osv: GHSA-p67v-3w7g-wjg7
• https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-p67v-3w7g-wjg7
• https://github.com/sparklemotion/nokogiri

CVE-2026-57437 · published 2026-06-19T16:37:13Z · modified 2026-09-10T03:51:09.256741560Z · JSON