CVE-2026-79771 Overview
CVE-2026-79771 is a memory leak vulnerability in Nokogiri, a widely used Ruby library for parsing XML and HTML documents. Versions before 1.19.3 leak heap allocations when the XSLT Stylesheet#transform method processes Ruby strings containing null bytes. Attackers can supply crafted input to transform parameters and force repeated allocations that are never freed. Long-running Ruby processes, such as web application workers, gradually exhaust available memory. The issue is tracked as CWE-401: Missing Release of Memory after Effective Lifetime.
Critical Impact
Remote unauthenticated attackers can trigger unbounded memory growth in Ruby applications that pass user-controlled data to Nokogiri XSLT transforms, resulting in denial of service.
Affected Products
- Nokogiri Ruby gem versions prior to 1.19.3
- Ruby applications invoking Nokogiri::XSLT::Stylesheet#transform with untrusted input
- Downstream services embedding Nokogiri for XML/XSLT processing
Discovery Timeline
- 2026-08-25 - CVE-2026-79771 published to the National Vulnerability Database
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-79771
Vulnerability Analysis
The defect resides in Nokogiri's XSLT transform binding. When the transform method receives Ruby strings that contain embedded null bytes (\\x00), the underlying C code allocates memory on the heap but fails to release it along the affected code path. Each invocation compounds the leak, so the impact scales with request volume rather than with a single malicious payload.
Exploitation does not corrupt memory or expose data. Confidentiality and integrity remain intact according to the CVSS vector, and only availability is affected. The vulnerability is reachable over the network because Nokogiri is commonly used to process XML supplied by remote clients in Rails and Sinatra applications.
Root Cause
The root cause is missing deallocation logic in the XSLT stylesheet transform path when input parameters contain null bytes. The C extension allocates buffers to marshal Ruby string data into libxslt, but the cleanup branch that handles null-byte-containing inputs does not free those buffers. This matches the CWE-401 pattern of memory that outlives its effective lifetime.
Attack Vector
An unauthenticated remote attacker submits input containing null bytes to any endpoint that forwards user data into a Nokogiri XSLT transform as a parameter. Repeatedly issuing such requests drives the Ruby worker's resident set size upward until the operating system kills the process or the host runs out of memory. Container-hosted workloads with strict memory limits fail faster. See the GitHub Security Advisory for Nokogiri and the VulnCheck Advisory on Nokogiri Memory Leak for additional technical context.
No verified public exploit code is available. The vulnerability mechanism is described in prose only.
Detection Methods for CVE-2026-79771
Indicators of Compromise
- Sustained growth in resident memory (RSS) of Ruby application workers without a corresponding increase in active sessions or workload
- Frequent worker restarts triggered by out-of-memory killers or process supervisors such as Puma, Unicorn, or systemd-oomd
- Inbound HTTP requests containing URL-encoded null bytes (%00) targeting endpoints that process XML or invoke XSLT
Detection Strategies
- Inventory application dependencies with bundle list | grep nokogiri and flag any installation of Nokogiri older than 1.19.3
- Instrument application performance monitoring to alert on abnormal heap growth in workers that call Nokogiri::XSLT APIs
- Correlate web application firewall logs for repeated payloads containing null bytes against XML or XSLT-processing routes
Monitoring Recommendations
- Track per-process memory metrics with tools such as ps, smem, or Prometheus node_exporter and alert on sustained increases beyond baseline
- Enable request-level tracing to identify endpoints where user input reaches Stylesheet#transform
- Log and rate-limit requests whose bodies or parameters contain null bytes before they reach the Ruby application
How to Mitigate CVE-2026-79771
Immediate Actions Required
- Upgrade the Nokogiri gem to version 1.19.3 or later in every affected application and rebuild container images
- Audit application code for calls to Nokogiri::XSLT::Stylesheet#transform that accept untrusted parameters and add input validation
- Restart long-running Ruby workers after upgrading to release any leaked memory accumulated before the patch
Patch Information
The Nokogiri maintainers released the fix in version 1.19.3. Update the dependency in Gemfile with gem 'nokogiri', '>= 1.19.3' and run bundle update nokogiri. Details are published in the GitHub Security Advisory GHSA-v2fc-qm4h-8hqv.
Workarounds
- Strip or reject null bytes from user-supplied input before passing it to Nokogiri::XSLT transform parameters
- Configure worker recycling to restart Ruby processes after a fixed number of requests, limiting the impact of accumulated leaks until the patch is deployed
- Isolate XSLT processing behind an authenticated internal service to reduce the exposure of the vulnerable code path to anonymous traffic
# Configuration example
bundle update nokogiri --conservative
bundle exec ruby -e 'require "nokogiri"; puts Nokogiri::VERSION'
# Expected output: 1.19.3 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
