Skip to content
OpenAdvisories
Medium · 5.5 CVE-2026-79769 EUVD-2026-65527GHSA-58vh-2xxg-v7j2

Nokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_args

Published Aug 25, 2026 · Updated Aug 26, 2026 · Assigned by VulnCheck

Description

Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protected internal Node#initialize_copy_with_args helper behind Node#dup and #clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a non-Node argument (e.g., a Namespace), it reads an xmlNs out of bounds, crashing the process. This is only triggerable by a programming error and cannot be triggered by untrusted input or normal use of the public API. Only CRuby is affected. Version 1.19.4 adds a type check and raises TypeError.

Affected products

VendorProductAffectedFixed
sparklemotion nokogiri < 1.19.4 1.19.4

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 ruby-nokogiri 1.19.4+dfsg-1 —
Debian 13 ruby-nokogiri No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS ruby-nokogiri No fix yet —
Ubuntu 24.04 LTS ruby-nokogiri No fix yet —
Ubuntu 18.04 LTS ruby-nokogiri No fix yet —
Ubuntu 16.04 LTS ruby-nokogiri No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS ruby-nokogiri No fix yet —
Ubuntu Pro 20.04 LTS ruby-nokogiri No fix yet —
Ubuntu Pro 14.04 LTS ruby-nokogiri No fix yet —

References