Description
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, calling Document#encoding= with an invalid encoding (e.g., a non-string, or a string containing a null byte) raises an exception, but only after freeing the document's current encoding string without replacing it. The document is left referencing freed memory, so the next call to Document#encoding reads invalid memory, which can cause a segfault or leak freed bytes into a Ruby String. Affects the CRuby (libxml2) implementation only; JRuby is not affected. This vulnerability is fixed in 1.19.4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sparklemotion | nokogiri | < 1.19.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby-nokogiri | 1.19.4+dfsg-1 | — |
| Debian 13 | ruby-nokogiri | No fix yet | — |
| Debian 12 | ruby-nokogiri | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | ruby-nokogiri | No fix yet | — |
| Ubuntu 26.04 LTS | ruby-nokogiri | No fix yet | — |
| Ubuntu 25.10 | ruby-nokogiri | No fix yet | — |
| Ubuntu 24.04 LTS | ruby-nokogiri | No fix yet | — |
| Ubuntu 18.04 LTS | ruby-nokogiri | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | ruby-nokogiri | No fix yet | — |
| Ubuntu Pro 22.04 LTS | ruby-nokogiri | No fix yet | — |
| Ubuntu Pro 20.04 LTS | ruby-nokogiri | No fix yet | — |
| Ubuntu Pro 14.04 LTS | ruby-nokogiri | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Capsule 6 | libsolv +1 | 1:0.7.20-7.el8sat | RHSA-2026:50223 |
| Red Hat Satellite Capsule 6 | openvox-agent | 8.24.1-3.el8sat | RHSA-2026:50263, RHSA-2026:50223, RHSA-2026:50222 |
| Red Hat Satellite Capsule 6 | openvox-server | 8.14.1-1.el8sat | RHSA-2026:50263, RHSA-2026:50223, RHSA-2026:50222 |
| Red Hat Satellite Capsule 6 | python-pillow +1 | 12.3.0-1.el8pc | RHSA-2026:50223, RHSA-2026:50222 |
| Red Hat Satellite Capsule 6 | python-pyjwt +2 | 2.13.0-1.el8pc | RHSA-2026:50223, RHSA-2026:50222 |
| Red Hat Satellite Capsule 6 | python3.12-pillow | 12.3.0-1.el9pc | RHSA-2026:50263, RHSA-2026:50221 |
| Red Hat Satellite Capsule 6 | python3.12-pyjwt +1 | 2.13.0-1.el9pc | RHSA-2026:50263 |
| Red Hat Satellite Capsule 6 | rubygem-faraday | 1.10.6-1.el8sat | RHSA-2026:50263, RHSA-2026:50223, RHSA-2026:50222 |
| Red Hat Satellite Capsule 6 | rubygem-nokogiri | 1.15.7-3.el8sat | RHSA-2026:50263, RHSA-2026:50223, RHSA-2026:50222 |
| Red Hat Satellite 6 | libsolv +1 | 1:0.7.20-7.el8sat | RHSA-2026:50223 |
| Red Hat Satellite 6 | openvox-agent | 8.24.1-3.el8sat | RHSA-2026:50263, RHSA-2026:50223, RHSA-2026:50222 |
| Red Hat Satellite 6 | openvox-server | 8.14.1-1.el8sat | RHSA-2026:50263, RHSA-2026:50223, RHSA-2026:50222 |
| Red Hat Satellite 6 | python-pillow +1 | 12.3.0-1.el8pc | RHSA-2026:50223, RHSA-2026:50222 |
| Red Hat Satellite 6 | python-pyjwt +2 | 2.13.0-1.el8pc | RHSA-2026:50223, RHSA-2026:50222 |
| Red Hat Satellite 6 | python3.12-pillow | 12.3.0-1.el9pc | RHSA-2026:50263, RHSA-2026:50221 |
| Red Hat Satellite 6 | python3.12-pyjwt +1 | 2.13.0-1.el9pc | RHSA-2026:50263 |
| Red Hat Satellite 6 | rubygem-faraday | 1.10.6-1.el8sat | RHSA-2026:50263, RHSA-2026:50223, RHSA-2026:50222 |
| Red Hat Satellite 6 | rubygem-katello | 4.14.0.21-1.el8sat | RHSA-2026:50263, RHSA-2026:50223, RHSA-2026:50222 |
| Red Hat Satellite 6 | rubygem-nokogiri | 1.15.7-3.el8sat | RHSA-2026:50263, RHSA-2026:50223, RHSA-2026:50222 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | ruby-nokogiri | 1.19.4-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | rubygem-nokogiri | 1.19.4-1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | nokogiri | < 1.19.4 | 1.19.4 | GHSA-5v8h-3h3q-446p |
Advisories 4
- RHSA-2026:50223 Red Hat Security Advisory: Satellite 6.16.12 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:50263 Red Hat Security Advisory: Satellite 6.18.8 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:50222 Red Hat Security Advisory: Satellite 6.17.10 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:50221 Red Hat Security Advisory: Satellite 6.19.3 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026