GHSA-9cv2-cfxc-v4v2

Low

Published: —Translated: 06/07/2026(UTC)NVD NIST

Summary

Nokogiri has a bug in methods called on allocated-but-uninitialized native wrapper classes inheriting from `Nokogiri::XML::Node`. This causes a NULL pointer dereference that could crash the process.

Risk Assessment

The risk is a potential application crash (process termination) when specific methods are called on improperly initialized objects. This could lead to service unavailability.

Recommendation

Immediately upgrade Nokogiri to version 1.19.4 or later, which includes a fix that checks for missing native data pointers and raises an exception.

Original NVD description (English source)

### Summary Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from `Nokogiri::XML::Node`. This caused a NULL pointer dereference that could crash the process. Nokogiri 1.19.4 checks for missing native data pointers and raises a