Which versions of Nokogiri are affected by CVE-2025-71346?

Nokogiri versions prior to 1.18.8 contain a heap buffer vulnerability in XML schema validation that could enable data disclosure or denial of service when processing untrusted XML documents with…. A patch is available.

How to fix or mitigate CVE-2025-71346?

Within 24 hours, identify all systems running Nokogiri by examining Gemfile.lock or application manifests, and document currently deployed Nokogiri versions in a spreadsheet or asset registry. Determine which applications require XML schema validation functionality, particularly those processing untrusted documents or user-supplied XSD schemas. Within 7 days, upgrade all development and staging deployments to Nokogiri 1.18.8 or later, run full regression tests on XML parsing and validation code paths, and prepare a production deployment plan with rollback procedures. Within 30 days, deploy Nokogiri 1.18.8 or later to all production systems and implement application-level controls restricting XML schema sources to documented trusted origins only, disabling automatic schema discovery where possible.

Nokogiri CVE-2025-71346

Q: What is the CVSS score of CVE-2025-71346?

CVE-2025-71346 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2025-210772 HIGH

Out-of-bounds Read (CWE-125)

2026-08-25 VulnCheck

GHSA-2ph4-3vr8-f2m3

Information Disclosure Buffer Overflow Nokogiri

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.7 LOW

Network-reachable via application input layer but AC:H due to required xsd:keyref/recursive-type schema structure; availability impact only, low severity consistent with MITRE assessment.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 25, 2026 - 17:17 EUVD

Source Code Evidence Fetched

Aug 25, 2026 - 16:01 vuln.today

Analysis Generated

Aug 25, 2026 - 16:01 vuln.today

CVE Published

Aug 25, 2026 - 15:15 cve.org

HIGH 8.7

DescriptionCVE.org

Nokogiri before 1.18.8 packages a vulnerable version of libxml2 (before 2.13.8) that contains a heap-based buffer under-read (CVE-2025-32415) in the xmlSchemaIDCFillNodeTables function in xmlschemas.c. The issue can be triggered when validating against an untrusted XML Schema, or when validating untrusted documents against trusted schemas that use xsd:keyref in combination with recursively defined types that have additional identity constraints. Upstream and MITRE rate this issue as low severity.

AnalysisAI

Heap-based buffer under-read in libxml2's XML Schema identity constraint processor affects all Nokogiri releases prior to 1.18.8, which bundle the vulnerable libxml2 library. The flaw in xmlSchemaIDCFillNodeTables can be triggered by supplying a crafted XSD schema or by submitting untrusted XML documents for validation against trusted schemas that combine xsd:keyref with recursively defined types carrying additional identity constraints. No public exploit has been identified at time of analysis, and upstream libxml2 maintainers and MITRE independently rate actual exploitability as low - in notable conflict with the NVD-assigned CVSS 4.0 base score of 8.7.

Technical ContextAI

Nokogiri is a widely used Ruby gem for XML and HTML parsing that bundles libxml2 as a native compiled dependency. The vulnerability - separately tracked as CVE-2025-32415 in the libxml2 project - is a CWE-125 (Out-of-Bounds Read) heap-based buffer under-read occurring in the xmlSchemaIDCFillNodeTables function within libxml2's xmlschemas.c. This function constructs internal lookup tables during XML Schema Definition (XSD) identity constraint validation, processing constructs such as xsd:keyref, xsd:key, and xsd:unique. The under-read is triggered when the schema contains xsd:keyref references in combination with recursively defined complex types that themselves carry additional identity constraints - causing the function to compute an incorrect buffer index. The affected CPE is cpe:2.3:a:sparklemotion:nokogiri:*:*:*:*:*:*:*:* for all versions below 1.18.8. Nokogiri installations that use system-provided libxml2 instead of the bundled version are only affected if the system libxml2 is itself below 2.13.8.

RemediationAI

The vendor-released patch is Nokogiri 1.18.8, which upgrades the bundled libxml2 to v2.13.8 and resolves CVE-2025-32415. Upgrade via 'gem update nokogiri' or pin 'gem "nokogiri", ">= 1.18.8"' in the Gemfile and run 'bundle update nokogiri'. The fix is confirmed in the vendor advisory at https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5w6v-399v-w3cc. As a compensating control prior to upgrading, applications can avoid passing untrusted, attacker-influenced XSD files as the schema argument to Nokogiri's validation methods - this eliminates the primary high-risk triggering condition. A secondary workaround is to disable XML Schema validation entirely for untrusted input and rely on application-layer validation instead, though this carries the trade-off of losing schema-enforced structural guarantees. Switching to a system-provided libxml2 package (if already updated to 2.13.8+) is viable but introduces a system-dependency management burden and may not be available on all deployment targets.