Nokogiri versions prior to 1.19.5 contain a use-after-free vulnerability in the CRuby native extension when replacing the value of an existing XML attribute via Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang=. This occurs if the attribute's child nodes were accessed before replacement, potentially causing invalid memory reads or segfaults. The issue is fixed in Nokogiri 1.19.5. JRuby is not affected. The maintainers rate this vulnerability as low severity due to the unusual usage pattern required to trigger it.