CVE-2025-71346

Name of the Vulnerable Software and Affected Versions Nokogiri versions prior to 1.18.8

Description Nokogiri includes a version of libxml2 that contains a heap-based buffer under-read (a condition where a program reads data before the beginning of a buffer in the heap memory) within the xmlSchemaIDCFillNodeTables() function in xmlschemas.c. This issue occurs during validation against an untrusted XML Schema or when validating untrusted documents against trusted schemas that utilize xsd:keyref combined with recursively defined types that have additional identity constraints.

Recommendations Update Nokogiri to version 1.18.8 or later.