The vulnerability resides in Nokogiri 1.x prior to 1.19.4 when installed for CRuby. A protected helper called initialize_copy_with_args expects its source argument to be an xmlNode but performs no type validation. If a developer mistakenly passes a different type, such as a Namespace, the method reads from an xmlNs value that is out‑of‑bounds, resulting in an illegal memory read and a process crash. Because the flaw is contained in a non‑public helper that is only invoked by internal code, it cannot be triggered by normal API use or by external data; it is limited to a programming error. The immediate consequence is a denial‑of‑service when the offending code executes.

Sparklemotion’s Nokogiri library running on CRuby implementations. Versions older than 1.19.4 are affected; upgrades to 1.19.4 or later fix the issue by adding a type check and raising a TypeError.

The CVSS score of 8.7 classifies the flaw as high severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited knowledge of exploitation. Because the defect requires intentional mis‑use of a protected method, exploitation would normally be limited to developers or attackers who can insert code into the application. Therefore, while the risk is high for internal developers, the practical likelihood of an external attack is low unless code is subverted or the library is extended by a malicious actor.