49 known security vulnerabilities

  • criticalGHSA-353f-x4gh-cqq8

    Nokogiri patches vendored libxml2 to resolve multiple CVEs

Show 48 more vulnerabilities
3 critical23 high12 moderate10 low
  • criticalGHSA-cr5j-953j-xw5p(CVE-2019-5477)

    Nokogiri Command Injection Vulnerability

  • criticalGHSA-fr52-4hqw-p27f(CVE-2016-4658)

    Nokogiri does not forbid namespace nodes in XPointer ranges

  • criticalGHSA-qxcg-xjjg-66mj(CVE-2019-11068)

    Nokogiri vulnerable to libxslt protection mechanism bypass

  • highGHSA-242x-7cm6-4w8j(CVE-2019-18197)

    Nokogiri affected by libxslt Use of Uninitialized Resource/Use After Free vulnerability

  • highGHSA-2rr5-8q37-2w7h(CVE-2021-41098)

    Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby

  • highGHSA-59gp-qqm7-cw4j(CVE-2021-30560)

    Nokogiri has vulnerable dependencies on libxml2 and libxslt

  • highGHSA-6qvp-r6r3-9p7h(CVE-2018-14404)

    Nokogiri NULL Pointer Dereference

  • highGHSA-6wj9-77wq-jq7p(CVE-2012-6685)

    Nokogiri is vulnerable to XML External Entity (XXE) attack

  • highGHSA-7553-jr98-vx47(CVE-2020-7595)

    libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation

  • highGHSA-8c56-cpmw-89x7(CVE-2017-9050)

    Out-of-bounds read in nokogiri

  • highGHSA-c4rq-3m3g-8wgx(CVE-2026-79770)

    Nokogiri CSS selector tokenizer has regular expression backtracking

  • highGHSA-cf46-6xxh-pc75(CVE-2019-13118)

    libxslt Type Confusion vulnerability that affects Nokogiri

  • highGHSA-cgx6-hpwq-fhv5(CVE-2022-50999)

    Integer Overflow or Wraparound in libxml2 affects Nokogiri

  • highGHSA-crjr-9rc5-ghw8(CVE-2022-24836)

    Nokogiri Inefficient Regular Expression Complexity

  • highGHSA-fq42-c5rg-92c2(CVE-2022-51000)

    Vulnerable dependencies in Nokogiri

  • highGHSA-gx8x-g87m-h5q6

    Denial of Service (DoS) in Nokogiri on JRuby

  • highGHSA-jc36-42cf-vqwj(CVE-2018-25032, PSF-2022-3)

    Nokogiri affected by zlib's Out-of-bounds Write vulnerability

  • highGHSA-jw9f-hh49-cvp9(CVE-2021-3517)

    Nokogiri contains libxml Out-of-bounds Write vulnerability

  • highGHSA-mrxw-mxhj-p664(CVE-2025-71406)

    Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEs

  • highGHSA-pf6m-fxpq-fg8v(CVE-2017-5029)

    Nokogiri implementation of libxslt lacks integer overflow checks

  • highGHSA-r58r-74gx-6wx3(CVE-2017-15412)

    Nokogiri gem, via libxml, is affected by DoS vulnerabilities

  • highGHSA-v4f8-2847-rwm7(CVE-2021-3518)

    Nokogiri Implements libxml2 version vulnerable to use-after-free

  • highGHSA-v6gp-9mmm-c6p5

    Out-of-bounds Write in zlib affects Nokogiri

  • highGHSA-vmfx-gcfq-wvm2(CVE-2019-5815)

    Nokogiri implementation of libxslt vulnerable to heap corruption

  • highGHSA-x2fm-93ww-ggvx(CVE-2017-16932)

    Nokogiri gem, via libxml, is affected by DoS vulnerabilities

  • highGHSA-xh29-r2w5-wx8m(CVE-2022-29181)

    Nokogiri Improperly Handles Unexpected Data Type

  • moderateGHSA-286v-pcf5-25rc(CVE-2021-3537)

    Nokogiri Implements libxml2 version vulnerable to null pointer dereferencing

  • moderateGHSA-2qc6-mcvw-92cw(CVE-2022-50998)

    Update bundled libxml2 to v2.10.3 to resolve multiple CVEs

  • moderateGHSA-4hm9-844j-jmxp(CVE-2019-13117)

    Uninitialized read in Nokogiri gem

  • moderateGHSA-5prr-v3j2-97mh(CVE-2026-57235)

    Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`

  • moderateGHSA-7rrm-v45f-jp64(CVE-2021-47996)

    Nokogiri updates packaged dependency on libxml2 from 2.9.10 to 2.9.12

  • moderateGHSA-882p-jqgm-f45g(CVE-2017-18258)

    Uncontrolled resource consumption in nokogiri

  • moderateGHSA-pxvg-2qj5-37jq(CVE-2023-54354)

    Nokogiri updates packaged libxml2 to v2.10.4 to resolve multiple CVEs

  • moderateGHSA-v2fc-qm4h-8hqv(CVE-2026-79771)

    Nokogiri XSLT transform has a memory leak

  • moderateGHSA-vr8q-g5c7-m54m(CVE-2020-26247)

    Nokogiri::XML::Schema trusts input by default, exposing risk of XXE vulnerability

  • moderateGHSA-x7rv-cr6v-4vm4(CVE-2018-8048)

    Cross-site Scripting in loofah

  • moderateGHSA-xc9x-jj77-9p9j(CVE-2024-58378)

    Nokogiri update packaged libxml2 to v2.12.5 to resolve CVE-2024-25062

  • moderateGHSA-xxx9-3xcr-gjj3

    XML Injection in Xerces Java affects Nokogiri

  • lowGHSA-5v8h-3h3q-446p(CVE-2026-57236)

    Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception

  • lowGHSA-5w6v-399v-w3cc(CVE-2025-71346)

    Nokogiri updates packaged libxml2 to v2.13.8 to resolve CVE-2025-32414 and CVE-2025-32415

  • lowGHSA-8678-w3jw-xfc2(CVE-2026-57234)

    Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247

  • lowGHSA-9cv2-cfxc-v4v2(CVE-2026-57434)

    Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes

  • lowGHSA-p67v-3w7g-wjg7(CVE-2026-57437)

    Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime

  • lowGHSA-phwj-rprq-35pp(CVE-2026-57435)

    Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`

  • lowGHSA-r95h-9x8f-r3f7(CVE-2024-58377)

    Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459

  • lowGHSA-vvfq-8hwr-qm4m(CVE-2025-71407)

    Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171

  • lowGHSA-wfpw-mmfh-qq69(CVE-2026-57438)

    Nokogiri: Possible Use-After-Free in XInclude Processing

  • lowGHSA-wjv4-x9w8-wm3h(CVE-2026-57436)

    Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type

Nokogiri (鋸) is an HTML, XML, SAX, and Reader parser. Among Nokogiri's many features is the ability to search documents via XPath or CSS3 selectors. XML is like violence - if it doesn’t solve your problems, you are not using enough of it.

Required Ruby Version

None

Authors

Aaron Patterson, Mike Dalessio

Versions

  1. 1.19.4

    1. source

      1. 1.19.4 source June 18, 2026 (4.17 MB)

    2. aarch64-linux-gnu

      1. 1.19.4 multi-abi June 18, 2026 (3.81 MB)

    3. aarch64-linux-musl

      1. 1.19.4 multi-abi June 18, 2026 (3.77 MB)

    4. arm64-darwin

      1. 1.19.4 multi-abi June 18, 2026 (6.24 MB)

    5. arm-linux-gnu

      1. 1.19.4 multi-abi June 18, 2026 (3.25 MB)

    6. arm-linux-musl

      1. 1.19.4 multi-abi June 18, 2026 (3.44 MB)

    7. java

      1. 1.19.4 multi-abi June 18, 2026 (12.5 MB)

    8. x64-mingw-ucrt

      1. 1.19.4 multi-abi June 18, 2026 (6.05 MB)

    9. x86_64-darwin

      1. 1.19.4 multi-abi June 18, 2026 (6.41 MB)

    10. x86_64-linux-gnu

      1. 1.19.4 multi-abi June 18, 2026 (3.89 MB)

    11. x86_64-linux-musl

      1. 1.19.4 multi-abi June 18, 2026 (3.87 MB)
  2. 1.19.3

    1. source

      1. 1.19.3 source April 27, 2026 (4.17 MB)

    2. aarch64-linux-gnu

      1. 1.19.3 multi-abi April 27, 2026 (3.8 MB)

    3. aarch64-linux-musl

      1. 1.19.3 multi-abi April 27, 2026 (3.76 MB)

    4. arm64-darwin

      1. 1.19.3 multi-abi April 27, 2026 (6.23 MB)

    5. arm-linux-gnu

      1. 1.19.3 multi-abi April 27, 2026 (3.25 MB)

    6. arm-linux-musl

      1. 1.19.3 multi-abi April 27, 2026 (3.43 MB)

    7. java

      1. 1.19.3 multi-abi April 27, 2026 (12.5 MB)

    8. x64-mingw-ucrt

      1. 1.19.3 multi-abi April 27, 2026 (6.04 MB)

    9. x86_64-darwin

      1. 1.19.3 multi-abi April 27, 2026 (6.4 MB)

    10. x86_64-linux-gnu

      1. 1.19.3 multi-abi April 27, 2026 (3.89 MB)

    11. x86_64-linux-musl

      1. 1.19.3 multi-abi April 27, 2026 (3.86 MB)
  3. 1.19.2

    1. source

      1. 1.19.2 source March 19, 2026 (4.16 MB)

    2. aarch64-linux-gnu

      1. 1.19.2 multi-abi March 19, 2026 (3.8 MB)

    3. aarch64-linux-musl

      1. 1.19.2 multi-abi March 19, 2026 (3.76 MB)

    4. arm64-darwin

      1. 1.19.2 multi-abi March 19, 2026 (6.23 MB)

    5. arm-linux-gnu

      1. 1.19.2 multi-abi March 19, 2026 (3.25 MB)

    6. arm-linux-musl

      1. 1.19.2 multi-abi March 19, 2026 (3.43 MB)

    7. java

      1. 1.19.2 multi-abi March 19, 2026 (12.5 MB)

    8. x64-mingw-ucrt

      1. 1.19.2 multi-abi March 19, 2026 (6.04 MB)

    9. x86_64-darwin

      1. 1.19.2 multi-abi March 19, 2026 (6.4 MB)

    10. x86_64-linux-gnu

      1. 1.19.2 multi-abi March 19, 2026 (3.89 MB)

    11. x86_64-linux-musl

      1. 1.19.2 multi-abi March 19, 2026 (3.86 MB)
  4. 1.19.1

    1. source

      1. 1.19.1 source February 16, 2026 (4.16 MB)

    2. aarch64-linux-gnu

      1. 1.19.1 multi-abi February 16, 2026 (3.8 MB)

    3. aarch64-linux-musl

      1. 1.19.1 multi-abi February 16, 2026 (3.76 MB)

    4. arm64-darwin

      1. 1.19.1 multi-abi February 16, 2026 (6.23 MB)

    5. arm-linux-gnu

      1. 1.19.1 multi-abi February 16, 2026 (3.25 MB)

    6. arm-linux-musl

      1. 1.19.1 multi-abi February 16, 2026 (3.43 MB)

    7. java

      1. 1.19.1 multi-abi February 16, 2026 (9.88 MB)

    8. x64-mingw-ucrt

      1. 1.19.1 multi-abi February 16, 2026 (6.04 MB)

    9. x86_64-darwin

      1. 1.19.1 multi-abi February 16, 2026 (6.4 MB)

    10. x86_64-linux-gnu

      1. 1.19.1 multi-abi February 16, 2026 (3.89 MB)

    11. x86_64-linux-musl

      1. 1.19.1 multi-abi February 16, 2026 (3.86 MB)
  5. 1.19.0

    1. source

      1. 1.19.0 source December 28, 2025 (4.16 MB)

    2. aarch64-linux-gnu

      1. 1.19.0 multi-abi December 28, 2025 (3.8 MB)

    3. aarch64-linux-musl

      1. 1.19.0 multi-abi December 28, 2025 (3.76 MB)

    4. arm64-darwin

      1. 1.19.0 multi-abi December 28, 2025 (6.23 MB)

    5. arm-linux-gnu

      1. 1.19.0 multi-abi December 28, 2025 (3.25 MB)

    6. arm-linux-musl

      1. 1.19.0 multi-abi December 28, 2025 (3.43 MB)

    7. java

      1. 1.19.0 multi-abi December 28, 2025 (9.88 MB)

    8. x64-mingw-ucrt

      1. 1.19.0 multi-abi December 28, 2025 (6.04 MB)

    9. x86_64-darwin

      1. 1.19.0 multi-abi December 28, 2025 (6.4 MB)

    10. x86_64-linux-gnu

      1. 1.19.0 multi-abi December 28, 2025 (3.89 MB)

    11. x86_64-linux-musl

      1. 1.19.0 multi-abi December 28, 2025 (3.86 MB)
  6. 1.4.2

    1. source

      1. 1.4.2 source May 22, 2010 (180 KB)

    2. java

      1. 1.4.2 multi-abi May 22, 2010 (1.95 MB)
Show all versions (1188 total)

SHA 256 checksum

← Previous version Next version →