{"schema_version":1,"title":"nokogiri (RubyGems) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 73 vulnerabilities in nokogiri (RubyGems): 0 in the last 7 days and 19 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, Duplicate Advisory: Nokogiri does not check the return value from xmlC14NExecute, was published on 25 August 2026.","url":"https://junglewise.ai/threats/technologies/nokogiri","json_url":"https://junglewise.ai/threats/technologies/nokogiri.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/nokogiri","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":4,"all_time":73,"critical":1,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":19,"last_365_days":35},"latest":[{"cvss":3.1,"slug":"duplicate-advisory-nokogiri-does-not-check-the-return-value-from-0a74b239","title":"Duplicate Advisory: Nokogiri does not check the return value from xmlC14NExecute","severity":"low","exploited":false,"published_at":"2026-08-25T18:31:53+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-nokogiri-does-not-check-the-return-value-from-0a74b239"},{"cvss":5.3,"slug":"nokogiri-unchecked-return-value-in-canonicalize-method-3863de91","title":"Nokogiri unchecked return value in canonicalize method","severity":"medium","exploited":false,"published_at":"2026-08-25T18:31:53+00:00","url":"https://junglewise.ai/threats/nokogiri-unchecked-return-value-in-canonicalize-method-3863de91"},{"cvss":7.5,"slug":"nokogiri-css-selector-tokenizer-redos-d52ae203","title":"Nokogiri CSS selector tokenizer ReDoS","severity":"high","exploited":false,"published_at":"2026-08-25T18:31:52+00:00","url":"https://junglewise.ai/threats/nokogiri-css-selector-tokenizer-redos-d52ae203"},{"cvss":3.1,"slug":"duplicate-advisory-nokogiri-xslt-transform-has-a-memory-leak-f4ef71b7","title":"Duplicate Advisory: Nokogiri XSLT transform has a memory leak","severity":"low","exploited":false,"published_at":"2026-08-25T18:31:52+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-nokogiri-xslt-transform-has-a-memory-leak-f4ef71b7"},{"cvss":3.1,"slug":"duplicate-advisory-nokogiri-css-selector-tokenizer-has-regular-3dc091bb","title":"Duplicate Advisory: Nokogiri CSS selector tokenizer has regular expression backtracking","severity":"low","exploited":false,"published_at":"2026-08-25T18:31:52+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-nokogiri-css-selector-tokenizer-has-regular-3dc091bb"},{"cvss":5.3,"slug":"nokogiri-xslt-transform-memory-leak-0441ddf7","title":"Nokogiri XSLT transform memory leak","severity":"medium","exploited":false,"published_at":"2026-08-25T18:31:52+00:00","url":"https://junglewise.ai/threats/nokogiri-xslt-transform-memory-leak-0441ddf7"},{"cve":"CVE-2026-79772","cvss":5.3,"epss":0.0034,"slug":"cve-2026-79772-nokogiri-cruby-unchecked-return-value-in-canonicalize","title":"Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on","severity":"medium","exploited":false,"published_at":"2026-08-25T16:17:28.743+00:00","url":"https://junglewise.ai/threats/cve-2026-79772-nokogiri-cruby-unchecked-return-value-in-canonicalize"},{"cve":"CVE-2026-79771","cvss":5.3,"epss":0.0042,"slug":"cve-2026-79771-nokogiri-xslt-stylesheet-transform-memory-leak","title":"Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null b","severity":"medium","exploited":false,"published_at":"2026-08-25T16:17:28.603+00:00","url":"https://junglewise.ai/threats/cve-2026-79771-nokogiri-xslt-stylesheet-transform-memory-leak"},{"cve":"CVE-2026-79770","cvss":7.5,"epss":0.0049,"slug":"cve-2026-79770-nokogiri-css-selector-tokenizer-regular-expression-dos","title":"Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string","severity":"high","exploited":false,"published_at":"2026-08-25T16:17:28.46+00:00","url":"https://junglewise.ai/threats/cve-2026-79770-nokogiri-css-selector-tokenizer-regular-expression-dos"},{"cve":"CVE-2026-79769","cvss":5.5,"epss":0.0031,"slug":"cve-2026-79769-nokogiri-invalid-memory-read-in-node-initialize-copy-with-args","title":"Nokogiri invalid memory read in Node#initialize_copy_with_args","severity":"medium","exploited":false,"published_at":"2026-08-25T16:17:28.32+00:00","url":"https://junglewise.ai/threats/cve-2026-79769-nokogiri-invalid-memory-read-in-node-initialize-copy-with-args"},{"cve":"CVE-2025-71407","slug":"cve-2025-71407-rejected-cve-duplicate","title":"Rejected CVE duplicate","severity":"info","exploited":false,"published_at":"2026-08-25T16:16:45.633+00:00","url":"https://junglewise.ai/threats/cve-2025-71407-rejected-cve-duplicate"},{"cve":"CVE-2025-71406","cvss":3.1,"slug":"cve-2025-71406-rejected-duplicate","title":"rejected duplicate","severity":"low","exploited":false,"published_at":"2026-08-25T16:16:45.497+00:00","url":"https://junglewise.ai/threats/cve-2025-71406-rejected-duplicate"},{"cve":"CVE-2025-71346","slug":"cve-2025-71346-duplicate-rejected-advisory","title":"duplicate rejected advisory","severity":"info","exploited":false,"published_at":"2026-08-25T16:16:45.32+00:00","url":"https://junglewise.ai/threats/cve-2025-71346-duplicate-rejected-advisory"},{"cve":"CVE-2024-58377","slug":"cve-2024-58377-duplicate-rejection","title":"duplicate rejection","severity":"info","exploited":false,"published_at":"2026-08-25T16:16:45.003+00:00","url":"https://junglewise.ai/threats/cve-2024-58377-duplicate-rejection"},{"cve":"CVE-2023-54354","slug":"cve-2023-54354-rejected-cve-duplicate","title":"Rejected CVE duplicate","severity":"info","exploited":false,"published_at":"2026-08-25T16:16:44.543+00:00","url":"https://junglewise.ai/threats/cve-2023-54354-rejected-cve-duplicate"},{"cve":"CVE-2022-51000","slug":"cve-2022-51000-rejected-duplicate-advisory","title":"Rejected duplicate advisory","severity":"info","exploited":false,"published_at":"2026-08-25T16:16:44.38+00:00","url":"https://junglewise.ai/threats/cve-2022-51000-rejected-duplicate-advisory"},{"cve":"CVE-2022-50999","cvss":3.1,"slug":"cve-2022-50999-duplicate-cve-entry","title":"Duplicate CVE entry","severity":"low","exploited":false,"published_at":"2026-08-25T16:16:44.24+00:00","url":"https://junglewise.ai/threats/cve-2022-50999-duplicate-cve-entry"},{"cve":"CVE-2022-50998","slug":"cve-2022-50998-duplicate-rejected","title":"duplicate rejected","severity":"info","exploited":false,"published_at":"2026-08-25T16:16:44.073+00:00","url":"https://junglewise.ai/threats/cve-2022-50998-duplicate-rejected"},{"cve":"CVE-2021-47996","slug":"cve-2021-47996-duplicate-rejection","title":"duplicate rejection","severity":"info","exploited":false,"published_at":"2026-08-25T16:16:42.93+00:00","url":"https://junglewise.ai/threats/cve-2021-47996-duplicate-rejection"},{"cve":"CVE-2026-57438","cvss":2.2,"epss":0.0013,"slug":"cve-2026-57438-nokogiri-use-after-free-in-xinclude-processing","title":"Nokogiri use-after-free in XInclude processing","severity":"info","exploited":false,"published_at":"2026-06-25T16:16:42.13+00:00","url":"https://junglewise.ai/threats/cve-2026-57438-nokogiri-use-after-free-in-xinclude-processing"},{"cve":"CVE-2026-57437","cvss":4,"epss":0.004,"slug":"cve-2026-57437-nokogiri-use-after-free-in-xml-xpathcontext","title":"Nokogiri use-after-free in XML::XPathContext","severity":"medium","exploited":false,"published_at":"2026-06-25T15:16:41.317+00:00","url":"https://junglewise.ai/threats/cve-2026-57437-nokogiri-use-after-free-in-xml-xpathcontext"},{"cve":"CVE-2026-57436","cvss":4,"epss":0.004,"slug":"cve-2026-57436-nokogiri-use-after-free-in-document-root-assignment","title":"Nokogiri use-after-free in Document root assignment","severity":"medium","exploited":false,"published_at":"2026-06-25T15:16:41.163+00:00","url":"https://junglewise.ai/threats/cve-2026-57436-nokogiri-use-after-free-in-document-root-assignment"},{"cve":"CVE-2026-57435","cvss":4,"epss":0.0046,"slug":"cve-2026-57435-nokogiri-use-after-free-in-xml-attribute-value-replacement","title":"Nokogiri use-after-free in XML attribute value replacement","severity":"medium","exploited":false,"published_at":"2026-06-25T15:16:41+00:00","url":"https://junglewise.ai/threats/cve-2026-57435-nokogiri-use-after-free-in-xml-attribute-value-replacement"},{"cve":"CVE-2026-57434","cvss":4,"epss":0.0046,"slug":"cve-2026-57434-nokogiri-null-pointer-dereference-in-xml-node-wrapper-classes","title":"Nokogiri NULL pointer dereference in XML Node wrapper classes","severity":"medium","exploited":false,"published_at":"2026-06-25T15:16:40.86+00:00","url":"https://junglewise.ai/threats/cve-2026-57434-nokogiri-null-pointer-dereference-in-xml-node-wrapper-classes"},{"cve":"CVE-2026-57236","cvss":4,"epss":0.0043,"slug":"cve-2026-57236-nokogiri-use-after-free-in-document-encoding-assignment","title":"Nokogiri use-after-free in Document encoding assignment","severity":"medium","exploited":false,"published_at":"2026-06-25T15:16:40.627+00:00","url":"https://junglewise.ai/threats/cve-2026-57236-nokogiri-use-after-free-in-document-encoding-assignment"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":19},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"rack (RubyGems)","slug":"rack","vulnerabilities":14,"url":"https://junglewise.ai/threats/technologies/rack"},{"name":"oj (RubyGems)","slug":"oj","vulnerabilities":11,"url":"https://junglewise.ai/threats/technologies/oj"},{"name":"jquery-rails (RubyGems)","slug":"jquery-rails","vulnerabilities":9,"url":"https://junglewise.ai/threats/technologies/jquery-rails"},{"name":"jquery-ui-rails (RubyGems)","slug":"jquery-ui-rails","vulnerabilities":8,"url":"https://junglewise.ai/threats/technologies/jquery-ui-rails"},{"name":"openc3 (RubyGems)","slug":"openc3","vulnerabilities":8,"url":"https://junglewise.ai/threats/technologies/openc3"},{"name":"lodash-rails (RubyGems)","slug":"lodash-rails","vulnerabilities":7,"url":"https://junglewise.ai/threats/technologies/lodash-rails"},{"name":"net-imap (RubyGems)","slug":"net-imap","vulnerabilities":7,"url":"https://junglewise.ai/threats/technologies/net-imap"},{"name":"loofah (RubyGems)","slug":"loofah","vulnerabilities":6,"url":"https://junglewise.ai/threats/technologies/loofah"},{"name":"action_text-trix (RubyGems)","slug":"action-text-trix","vulnerabilities":5,"url":"https://junglewise.ai/threats/technologies/action-text-trix"},{"name":"camaleon_cms (RubyGems)","slug":"camaleon-cms","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/camaleon-cms"},{"name":"fluentd (RubyGems)","slug":"fluentd","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/fluentd"},{"name":"view_component (RubyGems)","slug":"view-component","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/view-component"}],"technology":{"hub":true,"name":"nokogiri (RubyGems)","slug":"nokogiri","vendor":{"name":"RubyGems","slug":"rubygems","url":"https://junglewise.ai/threats/vendors/rubygems"},"aliases":[],"homepage":"https://nokogiri.org/","repo_url":"https://github.com/sparklemotion/nokogiri","description":"An open-source XML, HTML, SAX, and Reader parser for Ruby.","url":"https://junglewise.ai/threats/technologies/nokogiri"},"most_severe":[{"cve":"CVE-2019-11068","cvss":9.8,"epss":0.0523,"slug":"cve-2019-11068-nokogiri-libxslt-protection-mechanism-bypass-via-crafted-url","title":"Nokogiri libxslt protection mechanism bypass via crafted URL","severity":"critical","exploited":false,"published_at":"2022-05-13T01:21:57+00:00","url":"https://junglewise.ai/threats/cve-2019-11068-nokogiri-libxslt-protection-mechanism-bypass-via-crafted-url"},{"cve":"CVE-2019-13118","cvss":7.5,"epss":0.0519,"slug":"cve-2019-13118-nokogiri-libxslt-type-confusion-in-xsl-number-instruction","title":"Nokogiri libxslt type confusion in xsl:number instruction","severity":"high","exploited":false,"published_at":"2022-05-24T16:49:07+00:00","url":"https://junglewise.ai/threats/cve-2019-13118-nokogiri-libxslt-type-confusion-in-xsl-number-instruction"},{"cve":"CVE-2019-18197","cvss":7.5,"epss":0.0436,"slug":"cve-2019-18197-nokogiri-use-after-free-in-libxslt-dependency","title":"Nokogiri Use After Free in libxslt dependency","severity":"high","exploited":false,"published_at":"2022-05-24T16:59:28+00:00","url":"https://junglewise.ai/threats/cve-2019-18197-nokogiri-use-after-free-in-libxslt-dependency"},{"cve":"CVE-2026-79770","cvss":7.5,"epss":0.0049,"slug":"cve-2026-79770-nokogiri-css-selector-tokenizer-regular-expression-dos","title":"Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string","severity":"high","exploited":false,"published_at":"2026-08-25T16:17:28.46+00:00","url":"https://junglewise.ai/threats/cve-2026-79770-nokogiri-css-selector-tokenizer-regular-expression-dos"},{"cvss":7.5,"slug":"nokogiri-css-selector-tokenizer-redos-d52ae203","title":"Nokogiri CSS selector tokenizer ReDoS","severity":"high","exploited":false,"published_at":"2026-08-25T18:31:52+00:00","url":"https://junglewise.ai/threats/nokogiri-css-selector-tokenizer-redos-d52ae203"},{"cvss":6.3,"slug":"nokogiri-out-of-bounds-read-in-xml-nodeset-928dde3e","title":"Nokogiri out-of-bounds read in XML NodeSet","severity":"medium","exploited":false,"published_at":"2026-06-19T16:36:42+00:00","url":"https://junglewise.ai/threats/nokogiri-out-of-bounds-read-in-xml-nodeset-928dde3e"},{"cve":"CVE-2026-79769","cvss":5.5,"epss":0.0031,"slug":"cve-2026-79769-nokogiri-invalid-memory-read-in-node-initialize-copy-with-args","title":"Nokogiri invalid memory read in Node#initialize_copy_with_args","severity":"medium","exploited":false,"published_at":"2026-08-25T16:17:28.32+00:00","url":"https://junglewise.ai/threats/cve-2026-79769-nokogiri-invalid-memory-read-in-node-initialize-copy-with-args"},{"cve":"CVE-2019-13117","cvss":5.3,"epss":0.0646,"slug":"cve-2019-13117-nokogiri-uninitialized-read-in-libxslt-xsl-number-processing","title":"Nokogiri uninitialized read in libxslt xsl:number processing","severity":"medium","exploited":false,"published_at":"2022-05-24T16:49:06+00:00","url":"https://junglewise.ai/threats/cve-2019-13117-nokogiri-uninitialized-read-in-libxslt-xsl-number-processing"},{"cve":"CVE-2026-79771","cvss":5.3,"epss":0.0042,"slug":"cve-2026-79771-nokogiri-xslt-stylesheet-transform-memory-leak","title":"Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null b","severity":"medium","exploited":false,"published_at":"2026-08-25T16:17:28.603+00:00","url":"https://junglewise.ai/threats/cve-2026-79771-nokogiri-xslt-stylesheet-transform-memory-leak"},{"cve":"CVE-2026-79772","cvss":5.3,"epss":0.0034,"slug":"cve-2026-79772-nokogiri-cruby-unchecked-return-value-in-canonicalize","title":"Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on","severity":"medium","exploited":false,"published_at":"2026-08-25T16:17:28.743+00:00","url":"https://junglewise.ai/threats/cve-2026-79772-nokogiri-cruby-unchecked-return-value-in-canonicalize"}],"generated_at":"2026-09-26T17:07:00.185783+00:00"}