CVE-2026-57435

Nokogiri (Ruby): Before 1.19.4, the CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing an XML attribute’s value. If the attribute’s child node was already accessed, Nokogiri::XML::Attr#value= could free the underlying native node while the wrapper remained r...