Nokogiri
16 CVEs tracked since 2026. Since Jun 2026, none of them reached CISA KEV.
Nokogiri CVEs per month
| Month | CVEs | In CISA KEV |
|---|---|---|
| 2026-06 | 8 | 0 |
| 2026-07 | null or fewer | |
| 2026-08 | 8 | 0 |
Products
The products that kept showing up in Nokogiri's monthly top three, with their CVEs summed over those months.
Latest CVEs
The 15 most recently published vulnerabilities affecting Nokogiri.
- CVE-2026-79772Nokogiri before 1.19.1 Unchecked Return Value canonicalize5.3
- CVE-2026-79770Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer7.5
- CVE-2026-79771Nokogiri before 1.19.3 Memory Leak via XSLT Transform5.3
- CVE-2026-57438Nokogiri: Possible Use-After-Free in XInclude Processing6.6
- CVE-2026-57437Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime5.3
- CVE-2026-57436Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type5.3
- CVE-2026-57435Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`7.5
- CVE-2026-57434Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes7.5
- CVE-2026-57235Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`8.2
- CVE-2026-57234Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-262472.6
- CVE-2026-57236Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception8.2
- CVE-2022-23476Unchecked return value from xmlTextReaderExpand in Nokogiri7.5
- CVE-2022-29181Improper Handling of Unexpected Data Type in Nokogiri8.2
- CVE-2022-24836Inefficient Regular Expression Complexity in Nokogiri7.5
- CVE-2018-25032zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.7.5
The record
- Peak rank
- #179 in Jun 2026
- Busiest month shown
- Jun 2026, 8 CVEs
- Months with a KEV entry
- 0 since Jun 2026
- Monthly snapshots
- 2 since 2026