CVE-2022-51000: Nokogiri before 1.13.2 Multiple Vulnerabilities via libxml2 libxslt

Q: Which deployments are exposed to the libxslt issue?

CRuby deployments of Nokogiri before 1.13.2 that use packaged libraries are affected when they transform XML using untrusted XSL stylesheets. The stated impact for this path is denial of service.

Q: What parser configuration is required for the libxml2 issue to be reachable?

The application must parse an untrusted document with the DTDVALID parse option set to true and the NOENT option set to false. Under those conditions, the issue may allow denial of service, memory disclosure, or code execution.

Q: What version resolves the bundled-library exposure?

Upgrade Nokogiri to 1.13.2. This version updates the vendored libxml2 library to 2.9.13 and libxslt to 1.1.35.

Published Aug 25, 2026

Updated

Rejected reason: This CVE ID has been rejected as a duplicate.

Affected Software

2 affected components

rubygems/nokogiri<1.13.2

Nokogiri Nokogiri Ruby<=1.13.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade nokogiri to a version that resolves this vulnerability.
Fixed in 1.13.2
Upgrade
Upgrade nokogiri (vendored dependencies) to a version that resolves this vulnerability.
Fixed in 2.9.13
Upgrade
Upgrade nokogiri (vendored dependencies) to a version that resolves this vulnerability.
Fixed in 1.1.35

Event History

Aug 25, 2026

CVE Published

via MITRE·03:15 PM

Rejected

via MITRE·03:15 PM

Data Sourced

via NVD·04:16 PM

Description

Sep 8, 2026

Rejected

via MITRE·02:57 PM

Frequently Asked Questions

Which deployments are exposed to the libxslt issue?

CRuby deployments of Nokogiri before 1.13.2 that use packaged libraries are affected when they transform XML using untrusted XSL stylesheets. The stated impact for this path is denial of service.

What parser configuration is required for the libxml2 issue to be reachable?