{"id":"GHSA-9cv2-cfxc-v4v2","title":"Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes","summary":"Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes","severity":"low","cwe":["CWE-476"],"vendor":"nokogiri","product":"nokogiri","affected":["nokogiri < 1.19.4"],"patched":["nokogiri 1.19.4"],"published":"2026-06-19","updated":"2026-06-19","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-9cv2-cfxc-v4v2","references":[{"url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-9cv2-cfxc-v4v2"},{"url":"https://github.com/advisories/GHSA-9cv2-cfxc-v4v2"}],"tags":["ghsa","rubygems"],"ingestedAt":"2026-06-22T15:52:21.092Z","ecosystem":"rubygems","slug":"GHSA-9cv2-cfxc-v4v2","body":"## Overview\n\n### Summary\n\nNokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from `Nokogiri::XML::Node`. This caused a NULL pointer dereference that could crash the process.\n\nNokogiri 1.19.4 checks for missing native data pointers and raises a `RuntimeError`.\n\nJRuby is not affected.\n\n### Severity\n\nThe Nokogiri maintainers have evaluated this as low severity. This is only triggered by a programming error. It requires application code to call `.allocate` directly on a native-backed class and then invoke methods on the resulting uninitialized object. It cannot be triggered by untrusted input or through normal use of the public API.\n\n### Mitigation\n\nUpgrade to Nokogiri 1.19.4 or later.\n\nAvoid calling `.allocate` directly on Nokogiri native-backed classes. Use the documented constructors and factory methods instead.\n\n### Credit\n\nThis issue was responsibly reported by Zheng Yu from depthfirst.com.\n\n## Affected packages\n\n- `nokogiri < 1.19.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `nokogiri 1.19.4`","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}