CVE-2024-58377: Nokogiri before 1.16.5 libxml2 Dependency Update

Q: Are applications using Nokogiri actually exposed to the underlying libxml2 issue?

According to the Nokogiri maintainers, there is no impact to Nokogiri users because the affected libxml2 functionality is in the xmllint tool, which Nokogiri does not provide or expose.

Q: What version changes the bundled libxml2 dependency?

Nokogiri 1.16.5 updates its bundled libxml2 from 2.12.6 to 2.12.7 to address the underlying libxml2 CVE-2024-34459.

Published Aug 25, 2026

Updated

Nokogiri versions before 1.16.5 bundle libxml2 2.12.6, which is affected by CVE-2024-34459 in libxml2's xmllint tool. Nokogiri 1.16.5 upgrades the bundled libxml2 to 2.12.7 to address this. Per the maintainers, there is no impact to Nokogiri users because Nokogiri does not provide or expose the xmllint tool where the issue occurs.

Affected Software

1 affected component

npm/nokogiri<1.16.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade nokogiri to a version that resolves this vulnerability.
Fixed in 1.16.5
Upgrade
Upgrade libxml2 to a version that resolves this vulnerability.
Fixed in 2.12.7Patch CVE-2024-34459

Event History

Aug 25, 2026

CVE Published

via MITRE·03:15 PM

Data Sourced

via MITRE·03:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Are applications using Nokogiri actually exposed to the underlying libxml2 issue?

According to the Nokogiri maintainers, there is no impact to Nokogiri users because the affected libxml2 functionality is in the xmllint tool, which Nokogiri does not provide or expose.

What version changes the bundled libxml2 dependency?