CVE-2026-79769: Nokogiri Use-After-Free Vulnerability

CVE-2026-79769 Overview

CVE-2026-79769 is an out-of-bounds memory read in Nokogiri, a widely used Ruby XML and HTML parsing library. The flaw resides in the protected internal Node#initialize_copy_with_args helper that backs Node#dup and Node#clone. The helper unwraps its source argument as an xmlNode without performing a type check. When application code passes a non-Node object such as a Namespace, the helper reads an xmlNs structure out of bounds and crashes the Ruby process. Only CRuby is affected. Nokogiri 1.19.4 introduces a type check and raises TypeError instead.

Critical Impact
Applications calling the protected method with an incorrect argument type trigger an out-of-bounds read that crashes the CRuby process, producing a denial-of-service condition.

Affected Products

Nokogiri versions prior to 1.19.4 on CRuby
Ruby applications invoking Node#dup or Node#clone through the protected initialize_copy_with_args helper
Downstream libraries and services that expose Nokogiri node duplication to internal code paths

Discovery Timeline

2026-08-25 - CVE-2026-79769 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79769

Vulnerability Analysis

The vulnerability is a type confusion leading to an out-of-bounds read [CWE-843]. Nokogiri's C extension exposes a protected instance method, initialize_copy_with_args, that supports Node#dup and Node#clone. The implementation assumes the source argument wraps an xmlNode structure and dereferences it directly. When a caller supplies a different libxml2 object type such as a Nokogiri::XML::Namespace (which wraps xmlNs), the memory layout differs and the read extends beyond the allocated object bounds. The CRuby process terminates abruptly, producing a denial-of-service outcome. The advisory notes the issue cannot be reached through the documented public API or untrusted input; it requires a programming error in application code.

Root Cause

The root cause is a missing type check in the C extension. The initialize_copy_with_args helper unwraps the source Ruby object as an xmlNode* without validating that the underlying Data_Wrap_Struct corresponds to a Node. Non-Node inputs such as Namespace objects cause the code to interpret an xmlNs structure as an xmlNode, reading fields beyond the allocation.

Attack Vector

Exploitation requires local code that invokes the protected helper with a non-Node argument. The public dup and clone APIs invoked through normal use are not affected, and untrusted XML or HTML input alone cannot reach the vulnerable path. The realistic impact is process termination in applications containing the specific programming error, which produces a denial-of-service condition against long-running Ruby workers.

See the GitHub Security Advisory GHSA-g9g8-vgvw-g3vf and the VulnCheck Advisory on Nokogiri for full technical details.

Detection Methods for CVE-2026-79769

Indicators of Compromise

Unexpected termination of Ruby worker processes with signals such as SIGSEGV or SIGBUS originating from the Nokogiri C extension
Crash reports or core dumps referencing initialize_copy_with_args, xmlNode, or xmlNs symbols
Application logs showing repeated restarts of Puma, Unicorn, Sidekiq, or similar Ruby processes on the same code path

Detection Strategies

Inventory installed Nokogiri versions across Ruby applications using bundle list nokogiri or gem list nokogiri and flag any version below 1.19.4
Add static analysis rules to identify direct calls to the protected initialize_copy_with_args method, which should not appear in application code
Enable software composition analysis in continuous integration to fail builds that pin vulnerable Nokogiri releases

Monitoring Recommendations

Monitor process supervisors and container runtimes for abnormal exit codes from Ruby workloads and correlate with recent deploys
Forward Ruby crash logs and core-dump metadata to a centralized log platform for search and alerting
Track dependency updates in application manifests to confirm the fixed Nokogiri release is deployed everywhere

How to Mitigate CVE-2026-79769

Immediate Actions Required

Upgrade Nokogiri to version 1.19.4 or later in every Ruby application and container image
Rebuild and redeploy applications that vendor or bundle Nokogiri as a native extension
Audit application and library code for direct invocation of protected methods, particularly initialize_copy_with_args

Patch Information

Nokogiri 1.19.4 adds a type check in initialize_copy_with_args and raises TypeError when the source argument is not a Node. Update the dependency in Gemfile and run bundle update nokogiri, then rebuild container images and redeploy. Refer to the GitHub Security Advisory GHSA-g9g8-vgvw-g3vf for the upstream fix details.

Workarounds

Remove any code that calls protected Nokogiri internal methods and rely only on the documented public API
Wrap duplication logic in defensive checks that validate the object is a Nokogiri::XML::Node before cloning
Isolate affected Ruby workers behind process supervisors that restart on crash while patching proceeds

bash

# Configuration example: enforce fixed Nokogiri version
bundle update nokogiri --conservative
bundle list | grep nokogiri   # verify >= 1.19.4