Medium severity · published Aug 25, 2026
CVE-2026-79772
Nokogiri before 1.19.1 Unchecked Return Value canonicalize
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
nokogiri · sparklemotion
1.5.1 before 1.19.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-79772
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-79772
Vendor Advisory
https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-wx95-c6cv-8532
Third Party Advisory
https://www.vulncheck.com/advisories/nokogiri-before-unchecked-return-value-canonicalize
More from nokogiri
8.2
CVE-2026-57235
Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`
8.2
CVE-2026-57236
Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception
7.5
CVE-2026-79770
Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer
7.5
CVE-2026-57435
Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`
7.5
CVE-2026-57434
Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes