CVE-2026-79772 Overview
CVE-2026-79772 affects Nokogiri versions before 1.19.1, a widely used XML and HTML parsing library for Ruby. The vulnerability stems from an unchecked return value from xmlC14NExecute in the canonicalize method. On failure, the method returns an empty string rather than raising an exception. Attackers can leverage this behavior to bypass signature validation in downstream Security Assertion Markup Language (SAML) libraries. Invalid canonicalized XML is silently accepted as valid, undermining the integrity guarantees of XML Digital Signatures. The issue is tracked under [CWE-252: Unchecked Return Value].
Critical Impact
Attackers can bypass SAML signature validation by supplying malformed XML that produces empty canonicalization output, potentially enabling authentication bypass in dependent identity flows.
Affected Products
- Nokogiri versions prior to 1.19.1
- Ruby applications using Nokogiri for XML canonicalization
- Downstream SAML libraries relying on Nokogiri for signature verification
Discovery Timeline
- 2026-08-25 - CVE-2026-79772 published to the National Vulnerability Database (NVD)
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-79772
Vulnerability Analysis
Nokogiri exposes a canonicalize method that wraps libxml2's xmlC14NExecute function. Canonicalization (C14N) normalizes XML into a byte-exact representation used to compute and verify digital signatures. When xmlC14NExecute fails, it signals the error through a negative return value. Nokogiri does not check this return value. The method returns whatever buffer content exists, which is typically an empty string.
Downstream consumers treat this empty string as successful canonical output. In SAML flows, signature verification routines compute or compare digests against canonicalized data. An attacker who submits crafted XML that induces canonicalization failure receives an empty canonical form. The signature check then operates on attacker-controlled logical XML while the digest is computed over the empty output, allowing tampered assertions to be accepted.
Root Cause
The defect is a classic instance of [CWE-252]. The C-language binding layer invokes xmlC14NExecute but omits validation of its return code. Successful and failed executions are indistinguishable to the Ruby caller. No exception is raised, and no error status propagates. Consumers assume the returned string is authoritative canonical XML.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An adversary submits a SAML response, assertion, or other signed XML document that triggers a canonicalization failure inside Nokogiri, for example through malformed namespaces or unsupported node structures. The SAML library invokes canonicalize, receives an empty string, and proceeds with signature validation logic that no longer reflects the real document content. The result is an authentication or authorization decision based on unverified XML.
No verified public exploit code is available. Technical background is documented in the GitHub Security Advisory GHSA-wx95-c6cv-8532 and the VulnCheck Advisory on Nokogiri.
Detection Methods for CVE-2026-79772
Indicators of Compromise
- SAML responses or assertions with malformed namespace declarations or unusual node structures that still validate against your identity provider.
- Authentication events for accounts that did not originate a login request, correlated with unfamiliar source addresses.
- Application logs from Ruby services showing repeated calls to Nokogiri::XML::Document#canonicalize returning zero-length strings.
Detection Strategies
- Inventory Ruby applications and enumerate installed Nokogiri versions using bundle list nokogiri or gem list nokogiri to flag versions below 1.19.1.
- Instrument SAML processing code to log canonicalization output length and reject empty results before signature verification.
- Compare identity provider (IdP) issuance logs against service provider (SP) authentication events to detect assertions consumed without a matching IdP issuance.
Monitoring Recommendations
- Alert on authentication successes where the SAML assertion payload cannot be re-canonicalized to a non-empty value in an out-of-band check.
- Monitor for anomalous SAML message structures reaching production endpoints, including unusual XML entity or namespace patterns.
- Track dependency updates in continuous integration to ensure Nokogiri is pinned to a fixed release across all services.
How to Mitigate CVE-2026-79772
Immediate Actions Required
- Upgrade Nokogiri to version 1.19.1 or later in all Ruby applications and rebuild affected containers and packages.
- Audit direct and transitive dependencies to confirm no service pins an older Nokogiri release through a lockfile.
- Review SAML integration code to ensure the return value of canonicalize is checked and empty results raise an exception.
Patch Information
Nokogiri maintainers released 1.19.1 containing the fix, which validates the return value from xmlC14NExecute and surfaces failures to the caller. Detailed patch notes are available in the GitHub Security Advisory GHSA-wx95-c6cv-8532.
Workarounds
- Wrap calls to Nokogiri::XML::Document#canonicalize with a guard that raises an error when the result is nil or empty.
- Perform an independent canonicalization step using a second library or external tool before invoking signature verification.
- Restrict SAML endpoints to known IdP source addresses where feasible to reduce exposure until patching completes.
# Configuration example
bundle update nokogiri --conservative
bundle exec ruby -e 'require "nokogiri"; puts Nokogiri::VERSION'
# Expected output: 1.19.1 or higher
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
