---
id: GHSA-9cv2-cfxc-v4v2
title: >-
  Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper
  classes
summary: >-
  Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper
  classes
severity: low
cwe:
  - CWE-476
vendor: nokogiri
product: nokogiri
affected:
  - nokogiri < 1.19.4
patched:
  - nokogiri 1.19.4
published: '2026-06-19'
updated: '2026-06-19'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-9cv2-cfxc-v4v2'
references:
  - url: >-
      https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-9cv2-cfxc-v4v2
  - url: 'https://github.com/advisories/GHSA-9cv2-cfxc-v4v2'
tags:
  - ghsa
  - rubygems
ingestedAt: '2026-06-22T15:52:21.092Z'
ecosystem: rubygems
---

## Overview

### Summary

Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from `Nokogiri::XML::Node`. This caused a NULL pointer dereference that could crash the process.

Nokogiri 1.19.4 checks for missing native data pointers and raises a `RuntimeError`.

JRuby is not affected.

### Severity

The Nokogiri maintainers have evaluated this as low severity. This is only triggered by a programming error. It requires application code to call `.allocate` directly on a native-backed class and then invoke methods on the resulting uninitialized object. It cannot be triggered by untrusted input or through normal use of the public API.

### Mitigation

Upgrade to Nokogiri 1.19.4 or later.

Avoid calling `.allocate` directly on Nokogiri native-backed classes. Use the documented constructors and factory methods instead.

### Credit

This issue was responsibly reported by Zheng Yu from depthfirst.com.

## Affected packages

- `nokogiri < 1.19.4`

## Remediation

Upgrade to a patched release:

- `nokogiri 1.19.4`