CVE-2026-57434 | Nokogiri is an open source XML and HTML library for the Ruby… | CVSS 1.7 LOW

Description

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could crash the process. This vulnerability is fixed in 1.19.4.

Metadata

CVE ID: CVE-2026-57434
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-24 13:21 UTC
Published: 2026-06-25 14:32 UTC
Last updated: 2026-06-25 15:48 UTC
Primary CWE: CWE-476
CWE-476: NULL Pointer Dereference
Vendor / Product: sparklemotion / nokogiri
Sources: cve.org · NVD

Severity & Metrics

1.7 LOW CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
sparklemotion	nokogiri	—	< 1.19.4

Weakness (CWE)

CWE	Source	Description
CWE-476	cna	CWE-476: NULL Pointer Dereference

CVSS scores (1)

Score	Severity	Version	Source	Vector
1.7	LOW	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References (1)

https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-9cv2-cfxc-v4v2 https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-9cv2-cfxc-v4v2