By vendor

Nokogiri vulnerabilities

Known CVEs affecting Nokogiri products, prioritized by severity, with SEC.co remediation and detection guidance.

8 published vulnerabilities

• CVE-2026-57235HIGH 8.2

  Nokogiri, a widely-used Ruby library for parsing XML and HTML, contains an out-of-bounds read vulnerability in its NodeSet indexing method. When code calls the [] or slice method with a large negative index, the library's bounds check fails due to 32-bit truncation, allowing the operation to access memory outside the intended data structure. On standard Ruby (CRuby), this typically crashes the application; on JRuby, it silently returns incorrect data. The flaw affects all versions prior to 1.19.4.

• CVE-2026-57236HIGH 8.2

  Nokogiri, a widely-used Ruby library for parsing XML and HTML, contains a use-after-free vulnerability in its document encoding handler. When you attempt to set an invalid encoding on a document—such as passing a non-string value or a string with null bytes—the library frees the old encoding string but fails to properly initialize a replacement. Subsequent reads of the document's encoding then access already-freed memory, potentially causing the Ruby process to crash or leaking sensitive data from freed memory regions into application strings. The issue affects only the CRuby implementation using libxml2; JRuby users are unaffected. Nokogiri 1.19.4 and later resolve this defect.

• CVE-2026-57434HIGH 7.5

  Nokogiri, a widely-used Ruby library for parsing and manipulating XML and HTML documents, contains a flaw in how it initializes certain internal objects. When specific methods are called on these improperly initialized objects, the library crashes due to a null pointer error. This affects Nokogiri versions before 1.19.4. While the crash itself denies availability, it does not allow attackers to steal data or execute arbitrary code.

• CVE-2026-57435HIGH 7.5

  Nokogiri, a widely-used Ruby library for parsing and manipulating XML and HTML documents, contains a memory safety vulnerability in versions prior to 1.19.4. When an application modifies an XML attribute's value after the attribute node has been accessed by Ruby code, Nokogiri's native extension can inadvertently free memory that is still referenced elsewhere. This orphaned pointer can later cause the application to crash or behave unpredictably when the freed memory is accessed. The vulnerability requires no user interaction and can be triggered remotely if the affected code processes untrusted XML input.

• CVE-2026-57438MEDIUM 6.6

  Nokogiri, a widely-used Ruby library for parsing XML and HTML, has a memory safety flaw in its XInclude feature. When the library processes XInclude directives (a standard XML feature that lets documents reference external content), it frees memory without properly notifying Ruby objects that may still reference it. If your application code has kept a reference to a fallback element or namespace from an included file, using that reference afterward can read from or write to memory that's no longer valid, potentially causing crashes or unexpected behavior.

• CVE-2026-57436MEDIUM 5.3

  Nokogiri, a popular Ruby library for parsing and manipulating XML and HTML documents, contains a memory safety bug in versions prior to 1.19.4. The vulnerability allows an attacker to set an invalid type of object (specifically a DTD node) as a document's root element, bypassing validation checks. This causes the library to crash or behave unpredictably when the invalid structure is processed during garbage collection. The issue is resolved in version 1.19.4 and later.

• CVE-2026-57437MEDIUM 5.3

  Nokogiri, a widely-used Ruby library for parsing XML and HTML, contains a memory safety issue in its XPath evaluation feature. If application code manually creates an XPathContext object and then allows the underlying XML/HTML document to be garbage collected while the context is still in use, subsequent XPath queries can read from freed memory, potentially crashing the application. This is a narrow vulnerability—it requires specific patterns in application code and cannot be triggered by feeding a malicious document to the library. The standard document search methods (Document#xpath, Document#css) are not affected.

• CVE-2026-57234LOW 2.6

  Nokogiri, a widely-used Ruby library for parsing XML and HTML, has a flaw in its JRuby implementation that bypasses a security setting meant to prevent external network access during schema parsing. An attacker with authenticated access could craft a malicious schema file that, when parsed, fetches resources from attacker-controlled servers. This could enable Server-Side Request Forgery (SSRF) or XML External Entity (XXE) attacks, potentially leaking sensitive data or compromising internal systems. The vulnerability affects JRuby users only; the standard Ruby implementation is not impacted. The issue is resolved in version 1.19.4.