Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes (CVE-2026-57434) | HOL Guard CVE

High · CVSS 7.5CVE-2026-57434GHSA-9CV2-CFXC-V4V2

Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes

Answer in brief

CVE-2026-57434 records a High severity (CVSS 7.5) vulnerability in Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes. The current sources do not mark it as known exploited. The current feed maps nokogiri (rubygems), nokogiri (rubygems). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Jun 19, 2026Updated Sep 10, 2026Source checked Sep 10, 2026First seen by HOL Jun 19, 2026Material review Sep 10, 2026

Upstream Advisory

Key facts

Risk: High · CVSS 7.5
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps nokogiri (rubygems), nokogiri (rubygems). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
nokogirirubygems	<1.19.4	1.19.4
nokogirirubygems	>=0 <1.19.4	1.19.4

Recommended response

Check inventory. Check lockfiles and deployed manifests for nokogiri, nokogiri.
Review the reported fix. Update nokogiri to 1.19.4; nokogiri to 1.19.4 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Jun 19, 2026
Evidence: source:osv:source_dates:source-dates:record
Source modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:record
First seen by HOL
Jun 19, 2026

Sources and claim methodology

Upstream source description

### Summary Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from `Nokogiri::XML::Node`. This caused a NULL pointer dereference that could crash the process. Nokogiri 1.19.4 checks for missing native data pointers and raises a `RuntimeError`. JRuby is not affected. ### Severity The Nokogiri maintainers have evaluated this as low severity. This is only triggered by a programming error. It requires application code to call `.allocate` directly on a native-backed class and then invoke methods on the resulting uninitialized object. It cannot be triggered by untrusted input or through normal use of the public API. ### Mitigation Upgrade to Nokogiri 1.19.4 or later. Avoid calling `.allocate` directly on Nokogiri native-backed classes. Use the documented constructors and factory methods instead. ### Credit This issue was responsibly reported by Zheng Yu from depthfirst.com.

Quoted source text, attributed separately from HOL analysis.