CVE-2026-79772

The record

Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid.

Affected packages

Related vulnerabilities

• CVE-2026-19534 undici's WebSocket client crashes the whole Node.js process during the opening handshake… CWE-252
• CVE-2026-61857 ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by… CWE-252
• CVE-2026-11972 When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the… CWE-252
• CVE-2026-46521 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-252
• CVE-2026-40092 nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. CWE-252
• GHSA-27w2-87xv-37c6 nimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote… CWE-252
• CVE-2025-0028 An unchecked return value within the AMD Platform Management Framework (PMF) could allow… CWE-252
• CVE-2025-29938 An unchecked return value within the AMD Platform Management Framework (PMF) could allow… CWE-252