Nokogiri is an open‑source XML and HTML parsing library for Ruby. A defect in releases prior to 1.19.4 allows the class Nokogiri::XML::XPathContext to outlive its source document without retaining a reference, so the garbage collector can free the document while the context is still in use. This issue combines a use‑after‑free vulnerability (CWE‑416) with an improper object lifetime violation (CWE‑771). Evaluating an XPath expression with such an obsolete context can access invalid memory, leading to a segmentation fault. The flaw is not triggered by malicious input and is only exploitable when an application constructs an XPathContext directly and then lets the associated document become unreachable; it does not provide an attacker with code execution or data disclosure but can cause application crashes and potential denial of service.

The vendor is Sparklemotion Nokogiri for the Ruby programming language. All releases of the Nokogiri gem before 1.19.4 are affected. There are no specific vendor component or subcomponent limitations beyond the Ruby library itself.

The CVSS base score is 1.7, reflecting a low‑severity threat. EPSS score is < 1%, indicating a very low chance of exploitation. The vulnerability is not listed in CISA’s KEV catalog, meaning no publicly known exploits are in use. Because the flaw requires the application to instantiate XPathContext directly and to allow the source document to become unreachable, exploitation is limited to a design error rather than an attack surface. The primary impact is a denial‑of‑service through segfault; the likelihood of exploitation is low under normal use, but any code path that mismanages document lifetimes could trigger it.