Skip to content
cve.newCreate a CVE report

nokogiri

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

low2.0
CVE-2026-126064Package fixes recorded

Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Node#[]=` or `#lang=`

Nokogiri's CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an existing XML attribute via Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang=. If Ruby code had already accessed the attribute's child nodes, replacing the value could free those native child nodes while their wrappers remained reachable. Using one of those child nodes afterwards could cause an invalid read and a possible segfault.

Recorded fixes — nokogiri: 1.19.5. Check your release branch.

Exploitation not established

RubyGems / nokogiri
nokogiri RubyGems
Affected range Recorded fix
Earlier releases before 1.19.5Ecosystem versions1.19.5

Version evidence: OSV · GHSA-3w22-6jfg-527w

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.19.5"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "1.0.0",
    "1.0.1",
    "1.0.2",
    "1.0.3",
    "1.0.4",
    "1.0.5",
    "1.0.6",
    "1.0.7",
    "1.1.0",
    "1.1.1",
    "1.10.0",
    "1.10.0.rc1",
    "1.10.1",
    "1.10.10",
    "1.10.2",
    "1.10.3",
    "1.10.4",
    "1.10.5",
    "1.10.6",
    "1.10.7",
    "1.10.8",
    "1.10.9",
    "1.11.0",
    "1.11.0.rc1",
    "1.11.0.rc2",
    "1.11.0.rc3",
    "1.11.0.rc4",
    "1.11.1",
    "1.11.2",
    "1.11.3",
    "1.11.4",
    "1.11.5",
    "1.11.6",
    "1.11.7",
    "1.12.0",
    "1.12.0.rc1",
    "1.12.1",
    "1.12.2",
    "1.12.3",
    "1.12.4",
    "1.12.5",
    "1.13.0",
    "1.13.1",
    "1.13.10",
    "1.13.2",
    "1.13.3",
    "1.13.4",
    "1.13.5",
    "1.13.6",
    "1.13.7",
    "1.13.8",
    "1.13.9",
    "1.14.0",
    "1.14.0.rc1",
    "1.14.1",
    "1.14.2",
    "1.14.3",
    "1.14.4",
    "1.14.5",
    "1.15.0",
    "1.15.1",
    "1.15.2",
    "1.15.3",
    "1.15.4",
    "1.15.5",
    "1.15.6",
    "1.15.7",
    "1.16.0",
    "1.16.0.rc1",
    "1.16.1",
    "1.16.2",
    "1.16.3",
    "1.16.4",
    "1.16.5",
    "1.16.6",
    "1.16.7",
    "1.16.8",
    "1.17.0",
    "1.17.1",
    "1.17.2",
    "1.18.0",
    "1.18.0.rc1",
    "1.18.1",
    "1.18.10",
    "1.18.2",
    "1.18.3",
    "1.18.4",
    "1.18.5",
    "1.18.6",
    "1.18.7",
    "1.18.8",
    "1.18.9",
    "1.19.0",
    "1.19.1",
    "1.19.2",
    "1.19.3",
    "1.19.4",
    "1.2.0",
    "1.2.1",
    "1.2.2",
    "1.2.3",
    "1.3.0",
    "1.3.1",
    "1.3.2",
    "1.3.3",
    "1.4.0",
    "1.4.1",
    "1.4.2",
    "1.4.2.1",
    "1.4.3",
    "1.4.3.1",
    "1.4.4",
    "1.4.4.1",
    "1.4.4.2",
    "1.4.5",
    "1.4.6",
    "1.4.7",
    "1.5.0",
    "1.5.0.beta.1",
    "1.5.0.beta.2",
    "1.5.0.beta.3",
    "1.5.0.beta.4",
    "1.5.1",
    "1.5.1.rc1",
    "1.5.10",
    "1.5.11",
    "1.5.2",
    "1.5.3",
    "1.5.3.rc2",
    "1.5.3.rc3",
    "1.5.3.rc4",
    "1.5.3.rc5",
    "1.5.3.rc6",
    "1.5.4",
    "1.5.4.rc1",
    "1.5.4.rc2",
    "1.5.4.rc3",
    "1.5.5",
    "1.5.5.rc1",
    "1.5.5.rc2",
    "1.5.5.rc3",
    "1.5.6",
    "1.5.6.rc1",
    "1.5.6.rc2",
    "1.5.6.rc3",
    "1.5.7",
    "1.5.7.rc1",
    "1.5.7.rc2",
    "1.5.7.rc3",
    "1.5.8",
    "1.5.9",
    "1.6.0",
    "1.6.0.rc1",
    "1.6.1",
    "1.6.2",
    "1.6.2.1",
    "1.6.2.rc1",
    "1.6.2.rc2",
    "1.6.2.rc3",
    "1.6.3",
    "1.6.3.1",
    "1.6.3.rc1",
    "1.6.3.rc2",
    "1.6.3.rc3",
    "1.6.4",
    "1.6.4.1",
    "1.6.5",
    "1.6.6.1",
    "1.6.6.2",
    "1.6.6.3",
    "1.6.6.4",
    "1.6.7",
    "1.6.7.1",
    "1.6.7.2",
    "1.6.7.rc2",
    "1.6.7.rc3",
    "1.6.7.rc4",
    "1.6.8",
    "1.6.8.1",
    "1.6.8.rc1",
    "1.6.8.rc2",
    "1.6.8.rc3",
    "1.7.0",
    "1.7.0.1",
    "1.7.1",
    "1.7.2",
    "1.8.0",
    "1.8.1",
    "1.8.2",
    "1.8.3",
    "1.8.4",
    "1.8.5",
    "1.9.0",
    "1.9.0.rc1",
    "1.9.1"
  ]
}
low2.3
CVE-2026-126063Package fixes recorded

Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer

Nokogiri's HTML5 serializer did not escape text inside noscript elements, or < and > inside attribute values. When a document parsed with the default options is serialized, a browser with scripting enabled can parse the output into markup that Nokogiri's parser never produced. This is a mutation XSS for applications that sanitize untrusted HTML with Nokogiri::HTML5, allow noscript elements, and send the serialized output to browsers.

Recorded fixes — nokogiri: 1.19.5. Check your release branch.

Exploitation not established

RubyGems / nokogiri
nokogiri RubyGems
Affected range Recorded fix
From 1.12.0 before 1.19.5Ecosystem versions1.19.5

Version evidence: OSV · GHSA-4p39-36wj-23h4

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "1.12.0"
        },
        {
          "fixed": "1.19.5"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "1.12.0",
    "1.12.1",
    "1.12.2",
    "1.12.3",
    "1.12.4",
    "1.12.5",
    "1.13.0",
    "1.13.1",
    "1.13.10",
    "1.13.2",
    "1.13.3",
    "1.13.4",
    "1.13.5",
    "1.13.6",
    "1.13.7",
    "1.13.8",
    "1.13.9",
    "1.14.0",
    "1.14.0.rc1",
    "1.14.1",
    "1.14.2",
    "1.14.3",
    "1.14.4",
    "1.14.5",
    "1.15.0",
    "1.15.1",
    "1.15.2",
    "1.15.3",
    "1.15.4",
    "1.15.5",
    "1.15.6",
    "1.15.7",
    "1.16.0",
    "1.16.0.rc1",
    "1.16.1",
    "1.16.2",
    "1.16.3",
    "1.16.4",
    "1.16.5",
    "1.16.6",
    "1.16.7",
    "1.16.8",
    "1.17.0",
    "1.17.1",
    "1.17.2",
    "1.18.0",
    "1.18.0.rc1",
    "1.18.1",
    "1.18.10",
    "1.18.2",
    "1.18.3",
    "1.18.4",
    "1.18.5",
    "1.18.6",
    "1.18.7",
    "1.18.8",
    "1.18.9",
    "1.19.0",
    "1.19.1",
    "1.19.2",
    "1.19.3",
    "1.19.4"
  ]
}
low3.7
CVE-2026-126062Package fixes recorded

JRuby: NONET is bypassed for external DTDs and entities when the systemId uses a short-form IPv4 host

On JRuby, the NONET parse option did not block an external DTD or entity whose system identifier used a short-form IPv4 host, such as http://127.1/ or http://169.254.43518/, or was an absolute path such as /x.dtd in a document parsed from a network URL. An application that parses untrusted XML with DTDLOAD, DTDVALID or NOENT could be made to send network requests, potentially enabling SSRF.

Recorded fixes — nokogiri: 1.19.5. Check your release branch.

Exploitation not established

RubyGems / nokogiri
nokogiri RubyGems
Affected range Recorded fix
Earlier releases before 1.19.5Ecosystem versions1.19.5

Version evidence: OSV · GHSA-v995-44v6-5fqm

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.19.5"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "1.0.0",
    "1.0.1",
    "1.0.2",
    "1.0.3",
    "1.0.4",
    "1.0.5",
    "1.0.6",
    "1.0.7",
    "1.1.0",
    "1.1.1",
    "1.10.0",
    "1.10.0.rc1",
    "1.10.1",
    "1.10.10",
    "1.10.2",
    "1.10.3",
    "1.10.4",
    "1.10.5",
    "1.10.6",
    "1.10.7",
    "1.10.8",
    "1.10.9",
    "1.11.0",
    "1.11.0.rc1",
    "1.11.0.rc2",
    "1.11.0.rc3",
    "1.11.0.rc4",
    "1.11.1",
    "1.11.2",
    "1.11.3",
    "1.11.4",
    "1.11.5",
    "1.11.6",
    "1.11.7",
    "1.12.0",
    "1.12.0.rc1",
    "1.12.1",
    "1.12.2",
    "1.12.3",
    "1.12.4",
    "1.12.5",
    "1.13.0",
    "1.13.1",
    "1.13.10",
    "1.13.2",
    "1.13.3",
    "1.13.4",
    "1.13.5",
    "1.13.6",
    "1.13.7",
    "1.13.8",
    "1.13.9",
    "1.14.0",
    "1.14.0.rc1",
    "1.14.1",
    "1.14.2",
    "1.14.3",
    "1.14.4",
    "1.14.5",
    "1.15.0",
    "1.15.1",
    "1.15.2",
    "1.15.3",
    "1.15.4",
    "1.15.5",
    "1.15.6",
    "1.15.7",
    "1.16.0",
    "1.16.0.rc1",
    "1.16.1",
    "1.16.2",
    "1.16.3",
    "1.16.4",
    "1.16.5",
    "1.16.6",
    "1.16.7",
    "1.16.8",
    "1.17.0",
    "1.17.1",
    "1.17.2",
    "1.18.0",
    "1.18.0.rc1",
    "1.18.1",
    "1.18.10",
    "1.18.2",
    "1.18.3",
    "1.18.4",
    "1.18.5",
    "1.18.6",
    "1.18.7",
    "1.18.8",
    "1.18.9",
    "1.19.0",
    "1.19.1",
    "1.19.2",
    "1.19.3",
    "1.19.4",
    "1.2.0",
    "1.2.1",
    "1.2.2",
    "1.2.3",
    "1.3.0",
    "1.3.1",
    "1.3.2",
    "1.3.3",
    "1.4.0",
    "1.4.1",
    "1.4.2",
    "1.4.2.1",
    "1.4.3",
    "1.4.3.1",
    "1.4.4",
    "1.4.4.1",
    "1.4.4.2",
    "1.4.5",
    "1.4.6",
    "1.4.7",
    "1.5.0",
    "1.5.0.beta.1",
    "1.5.0.beta.2",
    "1.5.0.beta.3",
    "1.5.0.beta.4",
    "1.5.1",
    "1.5.1.rc1",
    "1.5.10",
    "1.5.11",
    "1.5.2",
    "1.5.3",
    "1.5.3.rc2",
    "1.5.3.rc3",
    "1.5.3.rc4",
    "1.5.3.rc5",
    "1.5.3.rc6",
    "1.5.4",
    "1.5.4.rc1",
    "1.5.4.rc2",
    "1.5.4.rc3",
    "1.5.5",
    "1.5.5.rc1",
    "1.5.5.rc2",
    "1.5.5.rc3",
    "1.5.6",
    "1.5.6.rc1",
    "1.5.6.rc2",
    "1.5.6.rc3",
    "1.5.7",
    "1.5.7.rc1",
    "1.5.7.rc2",
    "1.5.7.rc3",
    "1.5.8",
    "1.5.9",
    "1.6.0",
    "1.6.0.rc1",
    "1.6.1",
    "1.6.2",
    "1.6.2.1",
    "1.6.2.rc1",
    "1.6.2.rc2",
    "1.6.2.rc3",
    "1.6.3",
    "1.6.3.1",
    "1.6.3.rc1",
    "1.6.3.rc2",
    "1.6.3.rc3",
    "1.6.4",
    "1.6.4.1",
    "1.6.5",
    "1.6.6.1",
    "1.6.6.2",
    "1.6.6.3",
    "1.6.6.4",
    "1.6.7",
    "1.6.7.1",
    "1.6.7.2",
    "1.6.7.rc2",
    "1.6.7.rc3",
    "1.6.7.rc4",
    "1.6.8",
    "1.6.8.1",
    "1.6.8.rc1",
    "1.6.8.rc2",
    "1.6.8.rc3",
    "1.7.0",
    "1.7.0.1",
    "1.7.1",
    "1.7.2",
    "1.8.0",
    "1.8.1",
    "1.8.2",
    "1.8.3",
    "1.8.4",
    "1.8.5",
    "1.9.0",
    "1.9.0.rc1",
    "1.9.1"
  ]
}