nokogiri (RubyGems)
Advisories
69
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 1.19.4 or later clears every advisory below that has a fix.
Upgrade commands
bundler
bundle update nokogiri # Gemfile: gem "nokogiri", ">= 1.19.4"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-xqqh-3w52-q8p7 Duplicate Advisory: Nokogiri does not check the return value from xmlC14NExecute Withdrawn |
Medium | >= 1.5.1 | No fix yet |
| GHSA-rh9x-7xjc-vwx2 Duplicate Advisory: Nokogiri XSLT transform has a memory leak Withdrawn |
Medium | all versions | No fix yet |
| GHSA-5jhf-fpp7-v2pv Duplicate Advisory: Nokogiri CSS selector tokenizer has regular expression backtracking Withdrawn |
High | all versions | No fix yet |
| GHSA-phwj-rprq-35pp Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=` |
High EPSS 0.46% |
< 1.19.4 | 1.19.4 |
| GHSA-wfpw-mmfh-qq69 Nokogiri: Possible Use-After-Free in XInclude Processing |
Low EPSS 0.12% |
< 1.19.4 | 1.19.4 |
| GHSA-p67v-3w7g-wjg7 Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime |
Medium EPSS 0.40% |
< 1.19.4 | 1.19.4 |
| GHSA-wjv4-x9w8-wm3h Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type |
Medium EPSS 0.40% |
< 1.19.4 | 1.19.4 |
| GHSA-5prr-v3j2-97mh Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]` |
High EPSS 0.43% |
< 1.19.4 | 1.19.4 |
| GHSA-9cv2-cfxc-v4v2 Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes |
High EPSS 0.46% |
< 1.19.4 | 1.19.4 |
| GHSA-8678-w3jw-xfc2 Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247 |
Low EPSS 0.20% |
< 1.19.4 | 1.19.4 |
| GHSA-5v8h-3h3q-446p Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception |
High EPSS 0.43% |
< 1.19.4 | 1.19.4 |
| GHSA-v2fc-qm4h-8hqv Nokogiri XSLT transform has a memory leak |
Medium EPSS 0.42% |
< 1.19.3 | 1.19.3 |
| GHSA-c4rq-3m3g-8wgx Nokogiri CSS selector tokenizer has regular expression backtracking |
High EPSS 0.49% |
< 1.19.3 | 1.19.3 |
| GHSA-wx95-c6cv-8532 Nokogiri does not check the return value from xmlC14NExecute |
Medium EPSS 0.34% |
>= 1.5.1, < 1.19.1 | 1.19.1 |
| GHSA-353f-x4gh-cqq8 Nokogiri patches vendored libxml2 to resolve multiple CVEs |
Critical | < 1.18.9 | 1.18.9 |
| GHSA-jc9r-qcgw-fxq9 sparklemotion nokogiri hashmap.c hashmap_get_with_hash heap-based overflow Withdrawn |
Low EPSS 0.18% |
No fix yet | |
| GHSA-pf9w-gvcf-gv7m sparklemotion nokogiri hashmap.c hashmap_set_with_hash heap-based overflow Withdrawn |
Low EPSS 0.18% |
No fix yet | |
| GHSA-5w6v-399v-w3cc Nokogiri updates packaged libxml2 to v2.13.8 to resolve CVE-2025-32414 and CVE-2025-32415 |
Low | < 1.18.8 | 1.18.8 |
| GHSA-mrxw-mxhj-p664 Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEs |
High | < 1.18.4 | 1.18.4 |
| GHSA-5mwf-688x-mr7x Duplicate Advisory: Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171 Withdrawn |
Low | < 1.18.3 | 1.18.3 |
| GHSA-vvfq-8hwr-qm4m Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171 |
Low | < 1.18.3 | 1.18.3 |
| GHSA-r3w4-36x6-7r99 Duplicate Advisory: Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459 Withdrawn |
Low | < 1.16.5 | 1.16.5 |
| GHSA-r95h-9x8f-r3f7 Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459 |
Low | < 1.16.5 | 1.16.5 |
| GHSA-vcc3-rw6f-jv97 Duplicate Advisory: Use-after-free in libxml2 via Nokogiri::XML::Reader Withdrawn |
Medium | >= 1.16.0, < 1.16.2 | 1.16.2 |
| GHSA-vcc3-rw6f-jv97 Duplicate Advisory: Use-after-free in libxml2 via Nokogiri::XML::Reader Withdrawn |
Medium | < 1.15.6 | 1.15.6 |
| GHSA-xc9x-jj77-9p9j Nokogiri update packaged libxml2 to v2.12.5 to resolve CVE-2024-25062 |
Medium | >= 1.16.0, < 1.16.2 | 1.16.2 |
| GHSA-xc9x-jj77-9p9j Nokogiri update packaged libxml2 to v2.12.5 to resolve CVE-2024-25062 |
Medium | < 1.15.6 | 1.15.6 |
| GHSA-pxvg-2qj5-37jq Nokogiri updates packaged libxml2 to v2.10.4 to resolve multiple CVEs |
Medium | < 1.14.3 | 1.14.3 |
| GHSA-qv4q-mr5r-qprj Unchecked return value from xmlTextReaderExpand |
High EPSS 1.82% |
>= 1.13.8, < 1.13.10 | 1.13.10 |
| GHSA-2qc6-mcvw-92cw Update bundled libxml2 to v2.10.3 to resolve multiple CVEs |
Medium | < 1.13.9 | 1.13.9 |
| GHSA-59gp-qqm7-cw4j Nokogiri has vulnerable dependencies on libxml2 and libxslt |
High EPSS 17.63% |
< 1.13.2 | 1.13.2 |
| GHSA-jw9f-hh49-cvp9 Nokogiri contains libxml Out-of-bounds Write vulnerability |
High EPSS 16.99% |
< 1.11.4 | 1.11.4 |
| GHSA-v4f8-2847-rwm7 Nokogiri Implements libxml2 version vulnerable to use-after-free |
High EPSS 21.86% |
< 1.11.4 | 1.11.4 |
| GHSA-286v-pcf5-25rc Nokogiri Implements libxml2 version vulnerable to null pointer dereferencing |
Medium EPSS 3.60% |
< 1.11.4 | 1.11.4 |
| GHSA-vmfx-gcfq-wvm2 Nokogiri implementation of libxslt vulnerable to heap corruption |
High EPSS 1.82% |
< 1.10.5 | 1.10.5 |
| GHSA-242x-7cm6-4w8j Nokogiri affected by libxslt Use of Uninitialized Resource/Use After Free vulnerability |
High EPSS 4.45% |
< 1.10.5 | 1.10.5 |
| GHSA-cf46-6xxh-pc75 libxslt Type Confusion vulnerability that affects Nokogiri |
High EPSS 5.15% |
< 1.10.5 | 1.10.5 |
| GHSA-4hm9-844j-jmxp Uninitialized read in Nokogiri gem |
Medium EPSS 6.46% |
< 1.10.5 | 1.10.5 |
| GHSA-xh29-r2w5-wx8m Nokogiri Improperly Handles Unexpected Data Type |
High EPSS 3.23% |
< 1.13.6 | 1.13.6 |
| GHSA-cgx6-hpwq-fhv5 Integer Overflow or Wraparound in libxml2 affects Nokogiri |
High | < 1.13.5 | 1.13.5 |
| GHSA-r58r-74gx-6wx3 Nokogiri gem, via libxml, is affected by DoS vulnerabilities |
High EPSS 2.94% |
< 1.8.2 | 1.8.2 |
| GHSA-qxcg-xjjg-66mj Nokogiri vulnerable to libxslt protection mechanism bypass |
Critical EPSS 5.19% |
< 1.10.3 | 1.10.3 |
| GHSA-x2fm-93ww-ggvx Nokogiri gem, via libxml, is affected by DoS vulnerabilities |
High EPSS 6.45% |
< 1.8.1 | 1.8.1 |
| GHSA-62qp-3fxm-9wxf Nokogiri vulnerable to DoS while parsing XML documents |
Medium EPSS 2.08% |
>= 1.5.0, < 1.5.11 | 1.5.11 |
| GHSA-62qp-3fxm-9wxf Nokogiri vulnerable to DoS while parsing XML documents |
Medium EPSS 2.08% |
>= 1.6.0, < 1.6.1 | 1.6.1 |
| GHSA-jmhh-w7xp-wg39 Nokogiri vulnerable to DoS while parsing XML entities |
Medium EPSS 2.19% |
>= 1.5.0, < 1.5.11 | 1.5.11 |
| GHSA-jmhh-w7xp-wg39 Nokogiri vulnerable to DoS while parsing XML entities |
Medium EPSS 2.19% |
>= 1.6.0, < 1.6.1 | 1.6.1 |
| GHSA-6wj9-77wq-jq7p Nokogiri is vulnerable to XML External Entity (XXE) attack |
High EPSS 2.17% |
< 1.5.4 | 1.5.4 |
| GHSA-gx8x-g87m-h5q6 Denial of Service (DoS) in Nokogiri on JRuby |
High | < 1.13.4 | 1.13.4 |
| GHSA-xxx9-3xcr-gjj3 XML Injection in Xerces Java affects Nokogiri |
Medium | < 1.13.4 | 1.13.4 |
| GHSA-v6gp-9mmm-c6p5 Out-of-bounds Write in zlib affects Nokogiri |
High | < 1.13.4 | 1.13.4 |
| GHSA-crjr-9rc5-ghw8 Nokogiri Inefficient Regular Expression Complexity |
High EPSS 3.52% |
< 1.13.4 | 1.13.4 |
| GHSA-jc36-42cf-vqwj Nokogiri affected by zlib's Out-of-bounds Write vulnerability |
High EPSS 51.73% |
< 1.13.4 | 1.13.4 |
| GHSA-fq42-c5rg-92c2 Vulnerable dependencies in Nokogiri |
High | < 1.13.2 | 1.13.2 |
| GHSA-2rr5-8q37-2w7h Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby |
High EPSS 1.46% |
< 1.12.5 | 1.12.5 |
| GHSA-7rrm-v45f-jp64 Nokogiri updates packaged dependency on libxml2 from 2.9.10 to 2.9.12 |
Medium | < 1.11.4 | 1.11.4 |
| GHSA-vr8q-g5c7-m54m Nokogiri::XML::Schema trusts input by default, exposing risk of XXE vulnerability |
Medium EPSS 1.18% |
< 1.11.0 | 1.11.0 |
| GHSA-7553-jr98-vx47 libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation |
High EPSS 7.84% |
< 1.10.8 | 1.10.8 |
| GHSA-cr5j-953j-xw5p Nokogiri Command Injection Vulnerability |
Critical EPSS 5.90% |
< 1.10.4 | 1.10.4 |
| GHSA-6qvp-r6r3-9p7h Nokogiri NULL Pointer Dereference |
High EPSS 3.75% |
< 1.8.5 | 1.8.5 |
| GHSA-jxjr-5h69-qw3w Heap-based buffer overflow in nokogiri |
Medium EPSS 6.41% |
>= 1.6.0, < 1.6.7.2 | 1.6.7.2 |
| GHSA-7hp2-xwpj-95jq Denial of service or RCE from libxml2 and libxslt |
High EPSS 4.96% |
>= 1.6.0, < 1.6.8 | 1.6.8 |
| GHSA-fr52-4hqw-p27f Nokogiri does not forbid namespace nodes in XPointer ranges |
Critical EPSS 8.56% |
< 1.7.1 | 1.7.1 |
| GHSA-xjqg-9jvg-fgx2 Nokogiri subject to DoS via libxml2 vulnerability |
High EPSS 4.50% |
>= 1.6.0, < 1.6.7.1 | 1.6.7.1 |
| GHSA-q7wx-62r7-j2x7 Nokogiri vulnerable to libxml XML Entity Expansion |
Medium EPSS 6.29% |
>= 1.6.6.0, < 1.6.6.4 | 1.6.6.4 |
| GHSA-pf6m-fxpq-fg8v Nokogiri implementation of libxslt lacks integer overflow checks |
High EPSS 2.16% |
< 1.7.2 | 1.7.2 |
| GHSA-882p-jqgm-f45g Uncontrolled resource consumption in nokogiri |
Medium EPSS 2.74% |
< 1.8.2 | 1.8.2 |
| GHSA-x7rv-cr6v-4vm4 Cross-site Scripting in loofah |
Medium EPSS 1.93% |
< 1.8.3 | 1.8.3 |
| GHSA-8c56-cpmw-89x7 Out-of-bounds read in nokogiri |
High EPSS 4.63% |
< 1.8.1 | 1.8.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor