Nokogiri vulnerabilities

Products

• Nokogiri 21

Newest

• nokogiri Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=` CVE-2026-57435 Fix available 1.7 LowJune 19, 2026
• nokogiri Nokogiri: Possible Use-After-Free in XInclude Processing CVE-2026-57438 Fix available 2.2 LowJune 19, 2026
• nokogiri Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime CVE-2026-57437 Fix available 1.7 LowJune 19, 2026
• nokogiri Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type CVE-2026-57436 Fix available 1.7 LowJune 19, 2026
• nokogiri Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]` CVE-2026-57235 Fix available 6.3 MediumJune 19, 2026
• nokogiri Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes CVE-2026-57434 Fix available 1.7 LowJune 19, 2026
• nokogiri Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247 CVE-2026-57234 Fix available 2.6 LowJune 19, 2026
• nokogiri Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception CVE-2026-57236 Fix available 1.7 LowJune 19, 2026
• nokogiri Nokogiri before 1.19.3 Memory Leak via XSLT Transform CVE-2026-79771 Fix available 6.9 MediumMay 6, 2026
• nokogiri Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer CVE-2026-79770 Fix available 8.7 HighMay 6, 2026
• nokogiri Nokogiri before 1.19.1 Unchecked Return Value canonicalize CVE-2026-79772 Fix available 6.9 MediumFebruary 18, 2026
• nokogiri Unchecked return value from xmlTextReaderExpand in Nokogiri CVE-2022-23476 Fix available 7.5 HighDecember 8, 2022
• nokogiri, apple macos +1 more Improper Handling of Unexpected Data Type in Nokogiri CVE-2022-29181 Fix available 8.2 HighMay 20, 2022
• nokogiri, apple macos, debian linux +1 more +3 more Inefficient Regular Expression Complexity in Nokogiri CVE-2022-24836 Fix available 7.5 HighApril 11, 2022
• nokogiri, zlib, apple mac os x +28 more +30 more Nokogiri affected by zlib's Out-of-bounds Write vulnerability CVE-2018-25032 Public exploitFix available EPSS 51.7% 7.5 HighMarch 25, 2022
• nokogiri Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby CVE-2021-41098 Fix available 7.5 HighSeptember 27, 2021
• nokogiri, debian linux +1 more XXE in Nokogiri CVE-2020-26247 Fix available 2.6 LowDecember 30, 2020
• nokogiri, ruby nokogiri gem, debian linux +5 more +7 more Nokogiri vulnerable to DoS while parsing XML entities CVE-2013-6461 Fix available 6.5 MediumNovember 5, 2019
• nokogiri, ruby nokogiri gem, debian linux +5 more +7 more Nokogiri vulnerable to DoS while parsing XML documents CVE-2013-6460 Fix available 6.5 MediumNovember 5, 2019
• nokogiri, canonical ubuntu linux, debian linux +2 more Nokogiri Command Injection Vulnerability CVE-2019-5477 Fix available 9.8 CriticalAugust 16, 2019
• nokogiri, redhat cloudforms management engine, enterprise mrg +5 more +7 more Nokogiri is vulnerable to XML External Entity (XXE) attack CVE-2012-6685 Fix available 7.5 HighMay 27, 2015