CVE-2026-79769

Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protected internal Node#initialize_copy_with_args helper behind Node#dup and #clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a non-Node argument (e.g., a Namespace), it reads an xmlNs out of bounds, crashing the process. This is only triggerable by a programming error and cannot be triggered by untrusted input or normal use of the public API. Only CRuby is affected. Version 1.19.4 adds a type check and raises TypeError.

• CWE-843

• https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-g9g8-vgvw-g3vf
• https://www.vulncheck.com/advisories/nokogiri-before-invalid-memory-read-via-initialize-copy-with-args

Published

Aug 25, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-79762Termix is a web-based server management platform with SSH te…5.5
• CVE-2026-79763Termix is a web-based server management platform with SSH te…5.3
• CVE-2026-79764Termix is a web-based server management platform with SSH te…7.7
• CVE-2026-79766Termix is a web-based server management platform with SSH te…9.1
• CVE-2026-79767Gardener implements the automated management and operation o…5.5
• CVE-2026-79768Path equivalence: '/./' (single dot directory) vulnerability…5.3
• CVE-2026-7977Inappropriate implementation in Canvas in Google Chrome prio…6.3
• CVE-2026-79770Nokogiri versions before 1.19.3 contain regular expression d…7.5
• CVE-2026-79771Nokogiri versions before 1.19.3 contain a memory leak in the…5.3
• CVE-2026-79772Nokogiri versions before 1.19.1 fail to check the return val…5.3
• CVE-2026-79773Winter CMS before 1.2.13 contains a local file inclusion vul…4.9
• CVE-2026-79774Winter CMS versions before 1.2.13 contain an incomplete fix …8.4