CVE-2026-57434

HighCVSS 7.5

Published: 25/06/2026(UTC)Updated: 26/06/2026(UTC)Translated: 27/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

25th percentile — higher than 25% of all known CVEs

Summary

Vulnerability in the Nokogiri library for Ruby causes a NULL pointer dereference when calling certain methods on allocated-but-uninitialized native wrapper classes inheriting from Nokogiri::XML::Node. The issue is fixed in version 1.19.4.

Risk Assessment

An attacker can cause a process crash (denial of service) by exploiting this vulnerability, potentially disrupting applications using the Nokogiri library.

Recommendation

Immediately update the Nokogiri library to version 1.19.4 or later.

Original NVD description (English source)

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could crash the process. This vulnerability is fixed in 1.19.4.