# nokogiri (RubyGems) vulnerabilities 43 known vulnerabilities (1 critical, 12 high, 6 medium, 8 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://rubygems.org/gems/nokogiri ## Advisories (43) ### [CVE-2026-79772](https://cve.now/CVE-2026-79772): Nokogiri before 1.19.1 Unchecked Return Value canonicalize - Severity: Medium 6.9 - Published: Aug 25, 2026 - Affected: from 1.5.1, fixed in 1.19.1. ### [CVE-2026-79771](https://cve.now/CVE-2026-79771): Nokogiri before 1.19.3 Memory Leak via XSLT Transform - Severity: Medium 6.9 - Published: Aug 25, 2026 - Affected: fixed in 1.19.3. ### [CVE-2026-79770](https://cve.now/CVE-2026-79770): Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer - Severity: High 8.7 - Published: Aug 25, 2026 - Affected: fixed in 1.19.3. ### [CVE-2026-57438](https://cve.now/CVE-2026-57438): Nokogiri: Possible Use-After-Free in XInclude Processing - Severity: Low 2.2 - Published: Jun 25, 2026 - Affected: fixed in 1.19.4. ### [CVE-2026-57437](https://cve.now/CVE-2026-57437): Nokogiri: Possible Use-After-Free when directly using \`NokogirI::XML::XPathContext\` beyond document lifetime - Severity: Low 1.7 - Published: Jun 25, 2026 - Affected: fixed in 1.19.4. ### [CVE-2026-57436](https://cve.now/CVE-2026-57436): Nokogiri: Possible Use-After-Free when setting \`Document#root=\` to an invalid node type - Severity: Low 1.7 - Published: Jun 25, 2026 - Affected: fixed in 1.19.4. ### [CVE-2026-57435](https://cve.now/CVE-2026-57435): Nokogiri: Possible Use-After-Free when setting an attribute value via \`Nokogiri::XML::Attr#value=\` or \`#content=\` - Severity: Low 1.7 - Published: Jun 25, 2026 - Affected: fixed in 1.19.4. ### [CVE-2026-57434](https://cve.now/CVE-2026-57434): Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes - Severity: Low 1.7 - Published: Jun 25, 2026 - Affected: fixed in 1.19.4. ### [CVE-2026-57235](https://cve.now/CVE-2026-57235): Nokogiri: Possible Out-of-Bounds Read in \`Nokogiri::XML::NodeSet#\[\]\` - Severity: Medium 6.3 - Published: Jun 25, 2026 - Affected: fixed in 1.19.4. ### [CVE-2026-57234](https://cve.now/CVE-2026-57234): Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247 - Severity: Low 2.6 - Published: Jun 25, 2026 - Affected: fixed in 1.19.4. ### [CVE-2026-57236](https://cve.now/CVE-2026-57236): Nokogiri: Possible Use-After-Free when \`Nokogiri::XML::Document#encoding=\` raises an exception - Severity: Low 1.7 - Published: Jun 25, 2026 - Affected: fixed in 1.19.4. ### [CVE-2022-23476](https://cve.now/CVE-2022-23476): Unchecked return value from xmlTextReaderExpand in Nokogiri - Severity: High 7.5 - Published: Dec 8, 2022 - Affected: from 1.13.8, fixed in 1.13.10. ### [CVE-2022-29181](https://cve.now/CVE-2022-29181): Improper Handling of Unexpected Data Type in Nokogiri - Severity: High 8.2 - Published: May 20, 2022 - Affected: fixed in 1.13.6. ### [CVE-2022-24836](https://cve.now/CVE-2022-24836): Inefficient Regular Expression Complexity in Nokogiri - Severity: High 7.5 - Published: Apr 11, 2022 - Affected: fixed in 1.13.4. ### [CVE-2018-25032](https://cve.now/CVE-2018-25032): zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. - Severity: High 7.5 - Published: Mar 25, 2022 - Affected: fixed in 1.13.4. ### [CVE-2021-41098](https://cve.now/CVE-2021-41098): Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby - Severity: High 7.5 - Published: Sep 27, 2021 - Affected: fixed in 1.12.5. ### [CVE-2021-30560](https://cve.now/CVE-2021-30560): Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via… - Severity: High 8.8 - Published: Aug 3, 2021 - Affected: fixed in 1.13.2. ### [CVE-2021-3517](https://cve.now/CVE-2021-3517): There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. - Severity: High 8.6 - Published: May 19, 2021 - Affected: fixed in 1.11.4. ### [CVE-2021-3518](https://cve.now/CVE-2021-3518): There's a flaw in libxml2 in versions before 2.9.11. - Severity: Unrated - Published: May 18, 2021 - Affected: fixed in 1.11.4. ### [CVE-2021-3537](https://cve.now/CVE-2021-3537): A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing… - Severity: Unrated - Published: May 14, 2021 - Affected: fixed in 1.11.4. ### [CVE-2020-26247](https://cve.now/CVE-2020-26247): XXE in Nokogiri - Severity: Low 2.6 - Published: Dec 30, 2020 - Affected: fixed in 1.11.0. ### [CVE-2012-6685](https://cve.now/CVE-2012-6685): Nokogiri before 1.5.4 is vulnerable to XXE attacks - Severity: Unrated - Published: Feb 19, 2020 - Affected: fixed in 1.5.4. ### [CVE-2020-7595](https://cve.now/CVE-2020-7595): xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation. - Severity: High 7.5 - Published: Jan 21, 2020 - Affected: fixed in 1.10.8. ### [CVE-2019-5815](https://cve.now/CVE-2019-5815): Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption… - Severity: Unrated - Published: Dec 11, 2019 - Affected: fixed in 1.10.5. ### [CVE-2013-6461](https://cve.now/CVE-2013-6461): Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits - Severity: Unrated - Published: Nov 5, 2019 - Affected: from 1.5.0, fixed in 1.5.11; from 1.6.0, fixed in 1.6.1. ### [CVE-2013-6460](https://cve.now/CVE-2013-6460): Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents - Severity: Unrated - Published: Nov 5, 2019 - Affected: from 1.5.0, fixed in 1.5.11; from 1.6.0, fixed in 1.6.1. ### [CVE-2019-18197](https://cve.now/CVE-2019-18197): In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. - Severity: High 7.5 - Published: Oct 18, 2019 - Affected: fixed in 1.10.5. ### [CVE-2019-5477](https://cve.now/CVE-2019-5477): A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's \`Kernel.open\`… - Severity: Unrated - Published: Aug 16, 2019 - Affected: fixed in 1.10.4. ### [CVE-2019-13118](https://cve.now/CVE-2019-13118): In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid… - Severity: Medium 5.3 - Published: Jul 1, 2019 - Affected: fixed in 1.10.5. ### [CVE-2019-13117](https://cve.now/CVE-2019-13117): In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in… - Severity: Medium 5.3 - Published: Jul 1, 2019 - Affected: fixed in 1.10.5. ### [CVE-2019-11068](https://cve.now/CVE-2019-11068): libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon… - Severity: Critical 9.8 - Published: Apr 10, 2019 - Affected: fixed in 1.10.3. ### [CVE-2017-15412](https://cve.now/CVE-2017-15412): Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to… - Severity: Unrated - Published: Aug 28, 2018 - Affected: fixed in 1.8.2. ### [CVE-2018-14404](https://cve.now/CVE-2018-14404): A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invali - Severity: Medium 6.5 - Published: Jul 19, 2018 - Affected: fixed in 1.8.5. ### [CVE-2017-18258](https://cve.now/CVE-2017-18258): The xz\_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a craf - Severity: Unrated - Published: Apr 8, 2018 - Affected: fixed in 1.8.2. ### [CVE-2018-8048](https://cve.now/CVE-2018-8048): In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML… - Severity: Unrated - Published: Mar 27, 2018 - Affected: fixed in 1.8.3. ### [CVE-2017-16932](https://cve.now/CVE-2017-16932): parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities. - Severity: High 7.5 - Published: Nov 23, 2017 - Affected: fixed in 1.8.1. ### [CVE-2017-9050](https://cve.now/CVE-2017-9050): libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. - Severity: High 7.5 - Published: May 18, 2017 - Affected: fixed in 1.8.1. ### [CVE-2017-5029](https://cve.now/CVE-2017-5029): The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows… - Severity: Unrated - Published: Apr 24, 2017 - Affected: fixed in 1.7.2. ### [CVE-2016-4658](https://cve.now/CVE-2016-4658): xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other produ - Severity: Unrated - Published: Sep 25, 2016 - Affected: fixed in 1.7.1. ### [CVE-2015-8806](https://cve.now/CVE-2015-8806): dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an… - Severity: Unrated - Published: Apr 13, 2016 - Affected: from 1.6.0, fixed in 1.6.8. ### [CVE-2015-7499](https://cve.now/CVE-2015-7499): Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain… - Severity: Unrated - Published: Dec 15, 2015 - Affected: from 1.6.0, fixed in 1.6.7.2. ### [CVE-2015-5312](https://cve.now/CVE-2015-5312): The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not properly prevent entity expansion, which allows… - Severity: Unrated - Published: Dec 15, 2015 - Affected: from 1.6.0, fixed in 1.6.7.1. ### [CVE-2015-1819](https://cve.now/CVE-2015-1819): The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML… - Severity: Unrated - Published: Aug 14, 2015 - Affected: from 1.6.6.0, fixed in 1.6.6.4. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/rubygems/nokogiri Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.