CVE-2026-79769

Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protected internal Node#initialize_copy_with_args helper behind Node#dup and #clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a non-Node argument (e.g., a Namespace), it reads an xmlNs out of bounds, crashing the process. This is only triggerable by a programming error and cannot be triggered by untrusted input or normal use of the public API. Only CRuby is affected. Version 1.19.4 adds a type check and raises TypeError.

• CWE-843

• https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-g9g8-vgvw-g3vf
• https://www.vulncheck.com/advisories/nokogiri-before-invalid-memory-read-via-initialize-copy-with-args

Published

Aug 25, 2026

Last Modified

Aug 26, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-79750MCPHub is a unified hub for centrally managing and dynamical…7.7
• CVE-2026-79752CakePHP is a rapid development framework for PHP. Prior to 4…9.2
• CVE-2026-79754Nuclio is a "Serverless" framework for Real-Time Events and …7.1
• CVE-2026-79755Nuclio is a "Serverless" framework for Real-Time Events and …8
• CVE-2026-79756Nuclio is a "Serverless" framework for Real-Time Events and …8.7
• CVE-2026-7976Use after free in Views in Google Chrome prior to 148.0.7778…7.5
• CVE-2026-7977Inappropriate implementation in Canvas in Google Chrome prio…6.3
• CVE-2026-79770Nokogiri versions before 1.19.3 contain regular expression d…7.5
• CVE-2026-79771Nokogiri versions before 1.19.3 contain a memory leak in the…5.3
• CVE-2026-79772Nokogiri versions before 1.19.1 fail to check the return val…5.3
• CVE-2026-79773Winter CMS before 1.2.13 contains a local file inclusion vul…4.9
• CVE-2026-79774Winter CMS versions before 1.2.13 contain an incomplete fix …8.4