next-picomatch-cve-repro

Next.js bundled picomatch CVE-2026-33671 repro Minimal reproduction for: Next.js 16.2.4 ships with picomatch 4.0.3 vendored at nodemodules/next/dist/compiled/picomatch/, which is affected by CVE-2026-33671 HIGH. npm overrides cannot reach the bundled copy. Steps npm install 1. Inspect the vendore...

CVE-2024-58377

Rejected CVE Nokogiri before 1.16.5, when using bundled libxml2, is affected by the libxml2 flaw CVE-2024-34459...

CVE-2024-58378

Nokogiri before 1.15.6 and 1.16.x before 1.16.2, when using bundled libxml2, is affected by the libxml2 flaw CVE-2024-25062. Mitigation Upgrade Nokogiri to 1.15.6 or to 1.16.2 or later. If upgrading is not possible, compile and link Nokogiri against patched external libxml2 libraries. Installatio...

Linux Distros Unpatched Vulnerability : CVE-2024-58377

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri versions before 1.16.5 bundle libxml2 2.12.6, which is affected by CVE-2024-34459 in libxml2's xmllint tool. Nokogiri 1.16.5 upgrades the bundled libxm...

Uncontrolled Search Path Element

Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Uncontrolled Search Path Element through the bundled xmllint tool in the underlying dependency. An attacker can potentially influence the search path used for external libraries ...

CVE-2024-58377

Rejected reason: This CVE ID has been rejected as a duplicate...

UBUNTU-CVE-2024-58377

Nokogiri versions before 1.16.5 bundle libxml2 2.12.6, which is affected by CVE-2024-34459 in libxml2's xmllint tool. Nokogiri 1.16.5 upgrades the bundled libxml2 to 2.12.7 to address this. Per the maintainers, there is no impact to Nokogiri users because Nokogiri does not provide or expose the...

EUVD-2025-210773

Nokogiri before 1.18.4 bundles a vulnerable version of libxslt prior to 1.1.43 that contains two use-after-free vulnerabilities: CVE-2025-24855 use-after-free of the XPath context node due to xsltEvalXPathStringNs leaking xpathCtxt-node and CVE-2024-55549 use-after-free related to excluded result...

CVE-2025-71406

Nokogiri before 1.18.4 bundles libxslt prior to 1.1.43, which contains two use-after-free vulnerabilities: CVE-2025-24855 (XPath context node leak via xsltEvalXPathStringNs) and CVE-2024-55549 (excluded result prefixes/namespaces). Processing crafted XSLT can trigger memory corruption, potentiall...

CVE-2024-58377

Removed by vendor...

PT-2026-81340

Name of the Vulnerable Software and Affected Versions Nokogiri versions prior to 1.16.5 Description Nokogiri bundles libxml2 version 2.12.6, which contains an issue within the xmllint tool. However, there is no impact to users as Nokogiri does not provide or expose the xmllint tool. Recommendatio...