azure linux rubygem-nokogiri vulnerabilities

Latest azure linux rubygem-nokogiri CVEs

Newest publication first

1. CVE-2026-57438 Nokogiri: Possible Use-After-Free in XInclude Processing

   Published 2026-06-25

   Low·CVSS 2.2 EPSS 0.13%

   Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, XInclude substitution performed by Nokogiri::XML::Node#do_xinclude replaced each xi:include in place, freeing the include node along with its children (such as xi:fallback and its...

2. CVE-2026-57437 Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime

   Published 2026-06-25

   Low·CVSS 1.7 EPSS 0.40%

   Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::XPathContext did not keep its source document alive for garbage collection. If an XPathContext outlived its document and the document was collected, evaluating an XP...

3. CVE-2026-57436 Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type

   Published 2026-06-25

   Low·CVSS 1.7 EPSS 0.40%

   Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::Document#root= validated only that the new root was a Nokogiri::XML::Node, allowing a DTD node to be set as the document root. The result is a heap use-after-free du...

4. CVE-2026-57435 Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`

   Published 2026-06-25

   Low·CVSS 1.7 EPSS 0.46%

   Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri’s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute c...

5. CVE-2026-57434 Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes

   Published 2026-06-25

   Low·CVSS 1.7 EPSS 0.46%

   Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a NULL pointer derefer...

6. CVE-2026-57235 Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`

   Published 2026-06-25

   Medium·CVSS 6.3 EPSS 0.43%

   Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::NodeSet#[] (and its alias #slice) checked the requested index against the node set's bounds using a 32-bit-truncated copy of the index. A large negative index could...

7. CVE-2026-57234 Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247

   Published 2026-06-25

   Low·CVSS 2.6 EPSS 0.20%

   Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was not correctly enforced on the JRuby implementation. As a result, a sc...

8. CVE-2026-57236 Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception

   Published 2026-06-25

   Low·CVSS 1.7 EPSS 0.43%

   Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, calling Document#encoding= with an invalid encoding (e.g., a non-string, or a string containing a null byte) raises an exception, but only after freeing the document's current enco...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.