CVE-2021-3518: Nokogiri Implements libxml2 version vulnerable to use-after-free
Summary
CVE-2021-3518: Nokogiri Implements libxml2 version vulnerable to use-after-free. Affects nokogiri versions < 1.11.4. Fixed in 1.11.4. How to fix ↓
Also tracked for
- libxml2 · Alpine:v3.10
The same CVE-2021-3518 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Nokogiri is a RubyGem package that provides an interface for parsing and manipulating XML and HTML documents. It relies on the libxml2 library for its XML parsing functionality. Libxml2 is a widely used open-source library for parsing and manipulating XML files. However, versions of libxml2 prior to 2.9.11 contain a vulnerability that can be exploited by an attacker to trigger a use-after-free condition. This vulnerability can be exploited by submitting a crafted file to an application linked with libxml2. The use-after-free condition can lead to a variety of security issues, including the compromise of confidentiality, integrity, and availability of the affected system.
Vulnerability Detail
The vulnerability in libxml2 arises from a use-after-free condition. When a crafted file is processed by an application linked with libxml2, the vulnerability can be triggered. A use-after-free condition occurs when a program continues to use a memory region after it has been freed. This can lead to memory corruption and potentially allow an attacker to execute arbitrary code or perform other malicious actions. The impact of this vulnerability is significant, as it can compromise the confidentiality, integrity, and availability of the system.
How To Fix
Latest published version: 1.19.4 as of 22 Oct 2026
gem install nokogiri -v 1.19.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.11.4
This is the first release that contains the fix.
gem install nokogiri -v 1.11.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the Nokogiri package to the latest version as soon as possible.
Conclusion
The vulnerability in Nokogiri, which stems from the use of a vulnerable version of libxml2, can be exploited to trigger a use-after-free condition. This can lead to various security issues, including the compromise of confidentiality, integrity, and availability. It is crucial to update the Nokogiri package to version 1.11.4 or later to mitigate the risk of exploitation. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nokogiri →
FAQ
Nokogiri is a RubyGem package that provides an interface for parsing and manipulating XML and HTML documents.
Libxml2 is an open-source library used for parsing and manipulating XML files. It is used by Nokogiri for its XML parsing functionality.
A use-after-free vulnerability occurs when a program continues to use a memory region after it has been freed. This can lead to memory corruption and potentially allow an attacker to execute arbitrary code or perform other malicious actions.
This vulnerability can be exploited by submitting a crafted file to an application linked with libxml2. The use-after-free condition can be triggered, potentially leading to the compromise of confidentiality, integrity, and availability of the system.
To fix this vulnerability, update the Nokogiri package to version 1.11.4 or later. This version includes a fix for the underlying libxml2 vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for nokogiri.
