CVE-2025-71346 — nokogiri
CVE-2025-71346 is a security vulnerability in nokogiri. A fix is available for nokogiri — see the affected versions and patch details below.
Nokogiri before 1.18.8 Heap Buffer Under-read via XML Schema
Real-World Exposure
nokogiriReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.
Description
Summary
Nokogiri v1.18.8 upgrades its dependency libxml2 to v2.13.8.
libxml2 v2.13.8 addresses:
- CVE-2025-32414
- described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/889
- CVE-2025-32415
- described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/890
Impact
CVE-2025-32414: No impact
In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters.
There is no impact from this CVE for Nokogiri users.
CVE-2025-32415: Low impact
In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.
In the upstream issue, further context is provided by the maintainer:
The bug affects validation against untrusted XML Schemas (.xsd) and validation of untrusted documents against trusted Schemas if they make use of xsd:keyref in combination with recursively defined types that have additional identity constraints.
MITRE has published a severity score of 2.9 LOW (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) for this CVE.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 💎RubyGems | nokogiri | all versions | 1.18.8bundle update nokogiri --conservative |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for nokogiri, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update nokogiri to 1.18.8 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-71346 is resolved across your whole dependency graph.
Workarounds
Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
This flaw has a Low impact as it requires applications utilizing Nokogiri to process specially crafted, untrusted XML schemas or documents that include specific identity constraints. Exploitation is limited to scenarios where vulnerable applications perform XML validation on untrusted input, potentially leading to a…
No mitigation is currently available for this vulnerability. Red Hat recommends applying the appropriate security update as soon as it becomes available.Source: Red Hat security advisory for CVE-2025-71346 (CC BY 4.0)
Frequently Asked Questions
Is CVE-2025-71346 in your dependencies?
Find it across RubyGems, including transitive dependencies.