CVE-2024-58377: Nokogiri before 1.16.5 libxml2 Dependency Update
Published Aug 25, 2026
·Updated
Rejected reason: This CVE ID has been rejected as a duplicate.
Affected Software
2 affected components
npm/nokogiri<1.16.5
Nokogiri Nokogiri Ruby<1.16.5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nokogirito a version that resolves this vulnerability.Fixed in 1.16.5
Event History
Aug 25, 2026
CVE Published
via MITRE·03:15 PM
Rejected
via MITRE·03:15 PM
Data Sourced
via NVD·04:16 PM
Description
Sep 1, 2026
Rejected
via MITRE·08:33 PM
Frequently Asked Questions
1
Are applications using Nokogiri actually exposed to the underlying libxml2 issue?
According to the Nokogiri maintainers, there is no impact to Nokogiri users because the affected libxml2 functionality is in the xmllint tool, which Nokogiri does not provide or expose.
2
What version changes the bundled libxml2 dependency?
Nokogiri 1.16.5 updates its bundled libxml2 from 2.12.6 to 2.12.7 to address the underlying libxml2 CVE-2024-34459.