rubygems

nokogiri

62 Total advisories

62 Vulnerabilities

0 Malware

Dependency scanning

Check whether nokogiri is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

nokogiri

Vulnerabilities

Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type

Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes

Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247

Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`

Nokogiri: Possible Use-After-Free in XInclude Processing

Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception

Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime

Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`

Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby

Nokogiri::XML::Schema trusts input by default, exposing risk of XXE vulnerability

Uninitialized read in Nokogiri gem

Nokogiri vulnerable to libxslt protection mechanism bypass

libxslt Type Confusion vulnerability that affects Nokogiri

Nokogiri affected by libxslt Use of Uninitialized Resource/Use After Free vulnerability

Nokogiri CSS selector tokenizer has regular expression backtracking

Nokogiri XSLT transform has a memory leak

Nokogiri does not check the return value from xmlC14NExecute

Duplicate Advisory: Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459

Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459

Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEs

Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171

Nokogiri affected by zlib's Out-of-bounds Write vulnerability

Nokogiri patches vendored libxml2 to resolve multiple CVEs

Duplicate Advisory: Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171

Nokogiri updates packaged libxml2 to v2.13.8 to resolve CVE-2025-32414 and CVE-2025-32415

Nokogiri update packaged libxml2 to v2.12.5 to resolve CVE-2024-25062

Nokogiri NULL Pointer Dereference

sparklemotion nokogiri hashmap.c hashmap_get_with_hash heap-based overflow

sparklemotion nokogiri hashmap.c hashmap_set_with_hash heap-based overflow

Nokogiri Improperly Handles Unexpected Data Type

Duplicate Advisory: Use-after-free in libxml2 via Nokogiri::XML::Reader

Heap-based buffer overflow in nokogiri

Integer Overflow or Wraparound in libxml2 affects Nokogiri

Vulnerable dependencies in Nokogiri

Out-of-bounds Write in zlib affects Nokogiri

XML Injection in Xerces Java affects Nokogiri

Denial of Service (DoS) in Nokogiri on JRuby

Nokogiri updates packaged libxml2 to v2.10.4 to resolve multiple CVEs

Update bundled libxml2 to v2.10.3 to resolve multiple CVEs

Nokogiri updates packaged dependency on libxml2 from 2.9.10 to 2.9.12

Nokogiri vulnerable to libxml XML Entity Expansion

Nokogiri subject to DoS via libxml2 vulnerability

Nokogiri Implements libxml2 version vulnerable to use-after-free

Nokogiri contains libxml Out-of-bounds Write vulnerability

libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation

Cross-site Scripting in loofah

Nokogiri gem, via libxml, is affected by DoS vulnerabilities

Nokogiri Implements libxml2 version vulnerable to null pointer dereferencing

Nokogiri Command Injection Vulnerability

Nokogiri vulnerable to DoS while parsing XML documents

Nokogiri Inefficient Regular Expression Complexity

Nokogiri implementation of libxslt vulnerable to heap corruption

Nokogiri vulnerable to DoS while parsing XML entities

Nokogiri does not forbid namespace nodes in XPointer ranges

Denial of service or RCE from libxml2 and libxslt

Nokogiri implementation of libxslt lacks integer overflow checks

Nokogiri gem, via libxml, is affected by DoS vulnerabilities

Uncontrolled resource consumption in nokogiri

Nokogiri has vulnerable dependencies on libxml2 and libxslt

Unchecked return value from xmlTextReaderExpand

Out-of-bounds read in nokogiri

Nokogiri is vulnerable to XML External Entity (XXE) attack

Browse more RubyGems advisories

Start Securing