CVE-2026-126064 | Sparklemotion Nokogiri up to 1.19.4 CRuby native extension Node#lang= use after free

November 10, 2026 Yanac

A vulnerability was found in Sparklemotion Nokogiri up to 1.19.4. It has been rated as critical. The impacted element is the function Nokogiri::XML::Node#[]=/Nokogiri::XML::Node#lang= of the component CRuby native extension. Performing a manipulation results in use after free.

This vulnerability is known as CVE-2026-126064. Remote exploitation of the attack is possible. No exploit is available.

Upgrading the affected component is advised.VulDB Recent EntriesRead More