GHSA-9cv2-cfxc-v4v2: Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes

June 19, 2026

Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer dereference that could crash the process.

Nokogiri 1.19.4 checks for missing native data pointers and raises a RuntimeError.

JRuby is not affected.

References

github.com/advisories/GHSA-9cv2-cfxc-v4v2
github.com/sparklemotion/nokogiri/security/advisories/GHSA-9cv2-cfxc-v4v2

Code Behaviors & Features

Detect and mitigate GHSA-9cv2-cfxc-v4v2 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →