Nokogiri

This hub aggregates every CVE we track for Nokogiri, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Nokogiri.

• CVE-2026-79772Nokogiri before 1.19.1 Unchecked Return Value canonicalize5.3Aug 25, 2026
• CVE-2026-79771Nokogiri before 1.19.3 Memory Leak via XSLT Transform5.3Aug 25, 2026
• CVE-2026-79770Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer7.5Aug 25, 2026
• CVE-2026-79769Nokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_args5.5Aug 25, 2026
• CVE-2026-57438Nokogiri: Possible Use-After-Free in XInclude Processing6.6Jun 25, 2026
• CVE-2026-57437Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime5.3Jun 25, 2026
• CVE-2026-57436Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type5.3Jun 25, 2026
• CVE-2026-57435Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`7.5Jun 25, 2026
• CVE-2026-57434Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes7.5Jun 25, 2026
• CVE-2026-57235Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`8.2Jun 25, 2026
• CVE-2026-57234Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-262472.6Jun 25, 2026
• CVE-2026-57236Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception8.2Jun 25, 2026
• GHSA-phwj-rprq-35ppNokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`Jun 19, 2026
• GHSA-wfpw-mmfh-qq69Nokogiri: Possible Use-After-Free in XInclude ProcessingJun 19, 2026
• GHSA-p67v-3w7g-wjg7Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetimeJun 19, 2026