🛡️ CVE-2026-57236 — nokogiri

🟢 CVSS 2.0 — Low ✅ No Known Exploit CWE-416 OSV
2.0
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

Nokogiri: Possible Use-After-Free when Nokogiri::XML::Document#encoding= raises an exception

Summary

Calling Document#encoding= with an invalid encoding (e.g., a non-string, or a string containing a null byte) raises an exception, but only after freeing the document's current encoding string without replacing it. The document is left referencing freed memory, so the next call to Document#encoding reads invalid memory, which can cause a segfault or leak freed bytes into a Ruby String.

Affects the CRuby (libxml2) implementation only; JRuby is not affected.

Severity

The Nokogiri maintainers have evaluated this as low severity. Reaching it requires an unusual API-usage pattern that does not arise during normal use. The application must pass an invalid encoding to Document#encoding=, rescue the resulting exception, and then continue using the same document. Nokogiri 1.19.4 makes this pattern safe with no change to the public API. The document no longer references freed memory after the exception is raised.

Mitigation

Upgrade to Nokogiri 1.19.4 or later.

If users are unable to upgrade, avoid passing attacker-controlled values to Document#encoding=. Applications that only assign developer-authored encodings are not directly exposed.

Credit

This issue was responsibly reported by Zheng Yu from depthfirst.com.

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is low, an attacker needs no privileges on the target. No user interaction is required. Rated impact: confidentiality none, integrity none, availability low.

Weakness class

CVE-2026-57236 is classified as CWE-416: Use After Free. Memory is used after being released, so its contents may already belong to something else.

Affected software

CVE-2026-57236 is recorded against 1 package.

  • nokogiri (fixed in 1.19.4)

Timeline and source

Published on 19 June 2026 and last revised on 8 July 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

github.com (Web)
github.com (Package)

Details

Severity LOW
CVSS Score 2.0
CVSS Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
CWE CWE-416
Public Exploit ✅ No
Source OSV
Published 2026-06-19
Updated 2026-08-12
Modified 2026-07-08
Fix URL N/A

Affected Packages

Software From version Fixed in
nokogiri — 1.19.4

Similar Threats

Free Vulnerability Check

Is your site affected by CVE-2026-57236?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against CVE-2026-57236 and other known CVE records.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.