CVE-2026-79769: Access of Resource Using Incompatible Type ('Type Confusion') in sparklemotion nokogiri

CVE-2026-79769 describes a type confusion vulnerability in the Nokogiri library before version 1.19.4. The internal method Node#initialize_copy_with_args, used by Node#dup and #clone, unwraps its source argument as an xmlNode without verifying its type. If called with a non-Node argument such as a Namespace, it performs an out-of-bounds read of an xmlNs structure, leading to a process crash. This vulnerability requires a programming error to be triggered and cannot be exploited through normal or untrusted inputs. The fix in version 1.19.4 adds a type check that raises a TypeError when the argument type is incompatible.

The vulnerability can cause a denial-of-service condition by crashing the process due to an out-of-bounds memory read. It does not allow remote code execution or data corruption and cannot be triggered by untrusted input or normal API usage. Only CRuby implementations of Nokogiri are affected.

Upgrade to Nokogiri version 1.19.4 or later, which includes a type check that prevents this vulnerability by raising a TypeError on incompatible argument types. Since the issue requires a programming error to trigger and cannot be exploited via untrusted input, no additional mitigation is necessary.