CVE-2026-79769
Received Received - Intake

Memory Corruption in Nokogiri via Node#dup

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protected internal Node#initialize_copy_with_args helper behind Node#dup and #clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a non-Node argument (e.g., a Namespace), it reads an xmlNs out of bounds, crashing the process. This is only triggerable by a programming error and cannot be triggered by untrusted input or normal use of the public API. Only CRuby is affected. Version 1.19.4 adds a type check and raises TypeError.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-79769
EUVD
EUVD-2026-65527

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
sparklemotion nokogiri to 1.19.4 (exc)
nokogiri nokogiri to 1.19.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-843 The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Nokogiri before 1.19.4 has a bug where calling a protected method with the wrong type of argument can cause an out-of-bounds memory read. If code calls Node#initialize_copy_with_args with a non-Node object like a Namespace, it may read invalid memory and crash the process. This only happens if application code makes a programming error and calls the method incorrectly.

Detection Guidance

This vulnerability can only be triggered by application code explicitly calling the protected internal method with an incorrect type. It cannot be detected via network scanning or normal system commands. Review application code for calls to Node#dup, #clone, or Node#initialize_copy_with_args with non-Node arguments.

Impact Analysis

This vulnerability can cause your Ruby application to crash if it mistakenly calls a protected Nokogiri method with an incorrect argument type. It does not allow remote code execution or data theft and cannot be triggered by normal use or untrusted input.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar regulations as it does not lead to data breaches or unauthorized access. It may cause application instability, which could indirectly affect compliance if it disrupts critical operations.

Mitigation Strategies

Upgrade Nokogiri to version 1.19.4 or later. This version adds a type check that raises TypeError for invalid arguments, preventing the out-of-bounds memory read. No other mitigation is required as the issue cannot be triggered by normal use or untrusted input.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79769. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart