CVE-2025-71406: Nokogiri before 1.18.4 Use-After-Free via libxslt
Nokogiri before 1.18.4 bundles a vulnerable version of libxslt (prior to 1.1.43) that contains two use-after-free vulnerabilities: CVE-2025-24855 (use-after-free of the XPath context node due to xsltEvalXPathStringNs leaking xpathCtxt->node) and CVE-2024-55549 (use-after-free related to excluded result prefixes/namespaces). Processing crafted XSLT can trigger memory corruption. Nokogiri 1.18.4 upgrades the bundled libxslt to 1.1.43 to resolve these issues.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nokogirito a version that resolves this vulnerability.Fixed in 1.18.4Patch CVE-2025-24855 - Upgrade
Upgrade
Nokogirito a version that resolves this vulnerability.Fixed in 1.18.4Patch CVE-2024-55549
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Nokogiri before 1.18.4 are exposed because those releases bundle libxslt versions prior to 1.1.43. The issue is relevant where the application processes crafted XSLT.
What must an attacker provide to trigger the flaw?
An attacker needs crafted XSLT that reaches Nokogiri's bundled libxslt processing. The vulnerable libxslt code can then trigger use-after-free conditions involving XPath context nodes or excluded result prefixes/namespaces, leading to memory corruption.
What version resolves the bundled dependency issue?
Upgrade Nokogiri to 1.18.4 or later. Version 1.18.4 updates the bundled libxslt to 1.1.43, which resolves the identified use-after-free vulnerabilities.