CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

CSIRTSSecurity advisory fusion

← All products & vendors

Nokogiri — security advisories

8 advisorieslatest 2026-06-09⚡ RSS feed

Tracked Nokogiri products:

⚡ Watch Nokogiri

Get an email when a new Nokogiri advisory drops — max one per day, one-click unsubscribe.

CVE-2026-57435: Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`

highCVSS 7.5CVE-2026-57435msrc2026-06-09

CVE-2026-57436: Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type

mediumCVSS 5.3CVE-2026-57436msrc2026-06-09

CVE-2026-57236: Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception

highCVSS 8.2CVE-2026-57236msrc2026-06-09

CVE-2026-57438: Nokogiri: Possible Use-After-Free in XInclude Processing

mediumCVSS 6.6CVE-2026-57438msrc2026-06-09

CVE-2026-57235: Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`

highCVSS 8.2CVE-2026-57235msrc2026-06-09

CVE-2026-57234: Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247

lowCVSS 2.6CVE-2026-57234msrc2026-06-09

CVE-2026-57434: Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes

highCVSS 7.5CVE-2026-57434msrc2026-06-09

CVE-2026-57437: Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime

mediumCVSS 5.3CVE-2026-57437msrc2026-06-09

Nokogiri security advisories · CSIRTS