How severe is CVE-2026-126064?

No CVSS score has been assigned to CVE-2026-126064 yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by CVE-2026-126064?

CVE-2026-126064 affects the following packages: nokogiri (RubyGems). Ecosystems affected: RubyGems.

How do I fix CVE-2026-126064?

Update nokogiri to 1.19.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-126064 is resolved across your whole dependency graph.

How do I detect CVE-2026-126064 in my RubyGems dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for nokogiri, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2026-126064 if there is no patch (or I can't update yet)?

Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process.

Is CVE-2026-126064 actively exploited in the wild?

No public exploit code has been indexed for CVE-2026-126064 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What type of vulnerability is CVE-2026-126064?

CVE-2026-126064 is classified as Use After Free (CWE-416). This weakness type describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation.

When was CVE-2026-126064 published, and has it been updated?

CVE-2026-126064 was published on November 10, 2026 and was last updated on November 10, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

💎 RubyGems

Not in CISA KEV

CVE-2026-126064 — nokogiri

Fix: sparklemotion/nokogiri#3752

CVE-2026-126064 is a Use After Free vulnerability in nokogiri. A fix is available for nokogiri — see the affected versions and patch details below.

Nokogiri: Use-After-Free in Nokogiri when replacing an attribute value

Published

Nov 10, 2026

Updated

Nov 10, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Nov 10, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

💎nokogiri

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.

Description

Summary

Nokogiri's CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an existing XML attribute via Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang=. If Ruby code had already accessed the attribute's child nodes, replacing the value could free those native child nodes while their wrappers remained reachable. Using one of those child nodes afterwards could cause an invalid read and a possible segfault.

This is the same class of issue as GHSA-phwj-rprq-35pp, which was fixed for Attr#value= in Nokogiri 1.19.4.

Nokogiri 1.19.5 preserves all already-wrapped attribute child nodes before replacing the attribute value.

JRuby is not affected.

Severity

The Nokogiri maintainers have evaluated this as low severity. Reaching it requires an unusual API-usage pattern that does not arise during normal use. The application must directly access an attribute's child nodes and then replace that same attribute's value via Node#[]= or Node#lang=. Nokogiri 1.19.5 makes this pattern safe with no change to the public API.

Mitigation

Upgrade to Nokogiri 1.19.5 or later.

As a workaround, avoid accessing attribute child nodes directly via Attr#children or similar before replacing the same attribute's value.

Credit

This issue was responsibly reported by zx (@manus-pi).

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
💎RubyGems	`nokogiri`	all versions	1.19.5`bundle update nokogiri --conservative`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for nokogiri, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update nokogiri to 1.19.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-126064 is resolved across your whole dependency graph.
Workarounds
Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process.

Frequently Asked Questions

### Summary Nokogiri's CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an existing XML attribute via `Nokogiri::XML::Node#[]=` or `Nokogiri::XML::Node#lang=`. If Ruby code had already accessed the attribute's child nodes, replacing the value could free those native child nodes while their wrappers remained reachable. Using one of those child nodes afterwards could cause an invalid read and a possible segfault. This is the same class of issue as [GHSA-phwj-rprq-35pp](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-phwj-

O3 Security · Impact-Aware SCA

Is CVE-2026-126064 in your dependencies?

Find it across RubyGems, including transitive dependencies.

Scan my dependencies How O3 SCA works