Security advisories

low2026-06-19

Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`

GHSA-phwj-rprq-35pp

low2026-06-19

Nokogiri: Possible Use-After-Free in XInclude Processing

GHSA-wfpw-mmfh-qq69

low2026-06-19

Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime

GHSA-p67v-3w7g-wjg7

low2026-06-19

Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type

GHSA-wjv4-x9w8-wm3h

medium2026-06-19

Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`

GHSA-5prr-v3j2-97mh

low2026-06-19

Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes

GHSA-9cv2-cfxc-v4v2

low2026-06-19

Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247

GHSA-8678-w3jw-xfc2

low2026-06-19

Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception

GHSA-5v8h-3h3q-446p

medium2026-05-06

Nokogiri XSLT transform has a memory leak

GHSA-v2fc-qm4h-8hqv · CVE-2026-79771

high2026-05-06

Nokogiri CSS selector tokenizer has regular expression backtracking

GHSA-c4rq-3m3g-8wgx · CVE-2026-79770

medium2026-02-18

Nokogiri does not check the return value from xmlC14NExecute

GHSA-wx95-c6cv-8532 · CVE-2026-79772

critical2025-07-21

Nokogiri patches vendored libxml2 to resolve multiple CVEs

GHSA-353f-x4gh-cqq8

low2025-04-21

Nokogiri updates packaged libxml2 to v2.13.8 to resolve CVE-2025-32414 and CVE-2025-32415

GHSA-5w6v-399v-w3cc

high2025-03-14

Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEs

GHSA-mrxw-mxhj-p664

low2025-02-18

Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171

GHSA-vvfq-8hwr-qm4m

low2024-05-13

Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459

GHSA-r95h-9x8f-r3f7

medium2024-02-05

Nokogiri update packaged libxml2 to v2.12.5 to resolve CVE-2024-25062

GHSA-xc9x-jj77-9p9j

medium2023-04-11

Nokogiri updates packaged libxml2 to v2.10.4 to resolve multiple CVEs

GHSA-pxvg-2qj5-37jq

high2022-12-08

Unchecked return value from xmlTextReaderExpand

GHSA-qv4q-mr5r-qprj · CVE-2022-23476

medium2022-10-18

Update bundled libxml2 to v2.10.3 to resolve multiple CVEs

GHSA-2qc6-mcvw-92cw