RubyGems (Ruby)

nokogiri Known Vulnerabilities & Fixes

nokogiri has 37 known security vulnerabilities in RubyGems (Ruby). Upgrade to version 1.19.4 or later to resolve all known issues. Data sourced from OSV, enriched with EPSS exploit probability and CISA KEV.

37 Vulnerabilities

Low Immediate Risk

No actively exploited vulnerabilities detected. Monitor and update in your next maintenance window.

Recommended safe version: 1.19.4

Upgrading to 1.19.4 or later resolves all 37 known vulnerabilities in nokogiri. Run: gem install nokogiri -v 1.19.4

Is nokogiri in your project?

Check if you're affected and upgrade to 1.19.4 to stay secure.

Start Free Scan Get Alerted When New CVEs Drop

Total

Critical

High

Medium

Low

Security Summary

39 affected version ranges have been identified across these 37 advisories.
100% of known issues have a published fixed version.
Remediation: gem update nokogiri

Vulnerabilities

37 unique vulnerabilities — sorted by exploitation risk (KEV → EPSS → CVSS). Click a CVE/GHSA ID for full details. First disclosed Dec 13, 2017, most recently Jun 19, 2026 (3110 days apart).

CVE / GHSA	Severity	CVSS	EPSS	Summary	Affected	Fixed In
CVE-2019-11068 Nokogiri vulnerable to libxslt protection mechanism bypass	CRITICAL	9.8	—	Nokogiri vulnerable to libxslt protection mechanism bypass	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+108 more)	1.10.3
CVE-2019-5477 Nokogiri Command Injection Vulnerability	CRITICAL	9.8	—	Nokogiri Command Injection Vulnerability	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+109 more)	1.10.4
CVE-2016-4658 Nokogiri does not forbid namespace nodes in XPointer ranges	CRITICAL	9.8	—	Nokogiri does not forbid namespace nodes in XPointer ranges	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+93 more)	1.7.1
CVE-2026-79770 Nokogiri CSS selector tokenizer has regular expression backtracking	HIGH	7.5	—	Nokogiri CSS selector tokenizer has regular expression backtracking	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+189 more)	1.19.3
CVE-2025-71406 Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEs	HIGH	7.8	—	Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEs	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+179 more)	1.18.4
CVE-2021-30560 Nokogiri has vulnerable dependencies on libxml2 and libxslt	HIGH	8.8	—	Nokogiri has vulnerable dependencies on libxml2 and libxslt	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+137 more)	1.13.2
CVE-2021-3518 Nokogiri Implements libxml2 version vulnerable to use-after-free	HIGH	8.8	—	Nokogiri Implements libxml2 version vulnerable to use-after-free	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+124 more)	1.11.4
CVE-2017-15412 Nokogiri gem, via libxml, is affected by DoS vulnerabilities	HIGH	8.8	—	Nokogiri gem, via libxml, is affected by DoS vulnerabilities	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+97 more)	1.8.2
CVE-2021-3517 Nokogiri contains libxml Out-of-bounds Write vulnerability	HIGH	8.6	—	Nokogiri contains libxml Out-of-bounds Write vulnerability	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+124 more)	1.11.4
CVE-2022-50999 Integer Overflow or Wraparound in libxml2 affects Nokogiri	HIGH	8.6	—	Integer Overflow or Wraparound in libxml2 affects Nokogiri	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+140 more)	1.13.5
CVE-2017-5029 Nokogiri implementation of libxslt lacks integer overflow checks	HIGH	8.8	—	Nokogiri implementation of libxslt lacks integer overflow checks	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+94 more)	1.7.2
CVE-2022-29181 Nokogiri Improperly Handles Unexpected Data Type	HIGH	8.2	—	Nokogiri Improperly Handles Unexpected Data Type	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+141 more)	1.13.6
CVE-2022-23476 Unchecked return value from xmlTextReaderExpand	HIGH	7.5	—	Unchecked return value from xmlTextReaderExpand	1.13.8, 1.13.9	1.13.10
CVE-2019-5815 Nokogiri implementation of libxslt vulnerable to heap corruption	HIGH	7.5	—	Nokogiri implementation of libxslt vulnerable to heap corruption	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+110 more)	1.10.5
CVE-2019-18197 Nokogiri affected by libxslt Use of Uninitialized Resource/Use After Free vulnerability	HIGH	7.5	—	Nokogiri affected by libxslt Use of Uninitialized Resource/Use After Free vulnerability	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+110 more)	1.10.5
CVE-2019-13118 libxslt Type Confusion vulnerability that affects Nokogiri	HIGH	7.5	—	libxslt Type Confusion vulnerability that affects Nokogiri	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+110 more)	1.10.5
CVE-2017-16932 Nokogiri gem, via libxml, is affected by DoS vulnerabilities	HIGH	7.5	—	Nokogiri gem, via libxml, is affected by DoS vulnerabilities	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+96 more)	1.8.1
CVE-2012-6685 Nokogiri is vulnerable to XML External Entity (XXE) attack	HIGH	7.5	—	Nokogiri is vulnerable to XML External Entity (XXE) attack	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+43 more)	1.5.4
CVE-2022-24836 Nokogiri Inefficient Regular Expression Complexity	HIGH	7.5	—	Nokogiri Inefficient Regular Expression Complexity	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+139 more)	1.13.4
CVE-2018-25032 Nokogiri affected by zlib's Out-of-bounds Write vulnerability	HIGH	7.5	—	Nokogiri affected by zlib's Out-of-bounds Write vulnerability	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+139 more)	1.13.4
CVE-2021-41098 Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby	HIGH	7.5	—	Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+134 more)	1.12.5
CVE-2018-14404 Nokogiri NULL Pointer Dereference	HIGH	7.5	—	Nokogiri NULL Pointer Dereference	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+100 more)	1.8.5
CVE-2020-7595 libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation	HIGH	7.5	—	libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+113 more)	1.10.8
CVE-2015-8806 Denial of service or RCE from libxml2 and libxslt	HIGH	7.5	—	Denial of service or RCE from libxml2 and libxslt	1.6.0, 1.6.1, 1.6.2, 1.6.2.1 (+24 more)	1.6.8
CVE-2017-9050 Out-of-bounds read in nokogiri	HIGH	7.5	—	Out-of-bounds read in nokogiri	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+96 more)	1.8.1
CVE-2017-18258 Uncontrolled resource consumption in nokogiri	MEDIUM	6.5	—	Uncontrolled resource consumption in nokogiri	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+97 more)	1.8.2
CVE-2021-3537 Nokogiri Implements libxml2 version vulnerable to null pointer dereferencing	MEDIUM	5.9	—	Nokogiri Implements libxml2 version vulnerable to null pointer dereferencing	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+124 more)	1.11.4
CVE-2026-57235 Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`	MEDIUM	5.9	—	Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+190 more)	1.19.4
CVE-2026-79771 Nokogiri XSLT transform has a memory leak	MEDIUM	5.3	—	Nokogiri XSLT transform has a memory leak	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+189 more)	1.19.3
CVE-2026-79772 Nokogiri does not check the return value from xmlC14NExecute	MEDIUM	5.3	—	Nokogiri does not check the return value from xmlC14NExecute	1.10.0, 1.10.0.rc1, 1.10.1, 1.10.10 (+151 more)	1.19.1
CVE-2013-6460 Nokogiri vulnerable to DoS while parsing XML documents	MEDIUM	6.5	—	Nokogiri vulnerable to DoS while parsing XML documents	1.5.0, 1.5.1, 1.5.1.rc1, 1.5.10 (+26 more)	1.5.11, 1.6.1
CVE-2013-6461 Nokogiri vulnerable to DoS while parsing XML entities	MEDIUM	6.5	—	Nokogiri vulnerable to DoS while parsing XML entities	1.5.0, 1.5.1, 1.5.1.rc1, 1.5.10 (+26 more)	1.5.11, 1.6.1
CVE-2026-57435 Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`	LOW	4.8	—	Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+190 more)	1.19.4
CVE-2026-57437 Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime	LOW	4.8	—	Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+190 more)	1.19.4
CVE-2026-57436 Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type	LOW	4.8	—	Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+190 more)	1.19.4
CVE-2026-57434 Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes	LOW	4.8	—	Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+190 more)	1.19.4
CVE-2026-57236 Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception	LOW	4.8	—	Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception	1.0.0, 1.0.1, 1.0.2, 1.0.3 (+190 more)	1.19.4

About This Data

Vulnerability data for nokogiri is sourced from the Open Source Vulnerability (OSV) database, aggregating reports from GitHub Advisory Database, NIST NVD, and ecosystem-specific sources.

CVSS (Common Vulnerability Scoring System) scores reflect exploitability and impact. EPSS (Exploit Prediction Scoring System) scores indicate the probability of exploitation within the next 30 days. Vulnerabilities marked with are listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Related RubyGems (Ruby) Packages

Other packages in this ecosystem, ranked by shared vulnerabilities where available.

rexical

1 shared

rack actionpack rubygems-update rails-html-sanitizer decidim puma activestorage

Check Your Dependencies

Scan your project to check if you're using a vulnerable version of nokogiri.

Start Free Scan Create Free Account

Data from OSV DatabaseUpdated daily200K+ vulnerabilities indexed