CVE-2025-71406: Nokogiri Use-After-Free Vulnerability

CVE-2025-71406 Overview

CVE-2025-71406 affects Nokogiri versions prior to 1.18.4. The library bundles a vulnerable version of libxslt (before 1.1.43) that contains two use-after-free vulnerabilities. The bundled flaws are tracked as CVE-2025-24855 and CVE-2024-55549. Processing attacker-crafted XSLT stylesheets through Nokogiri can trigger memory corruption in the underlying libxslt library. Nokogiri 1.18.4 upgrades the bundled libxslt to 1.1.43 to resolve both issues.

Critical Impact
Applications that parse or transform untrusted XSLT with Nokogiri below 1.18.4 can suffer memory corruption leading to process crashes or potential code execution.

Affected Products

Nokogiri versions prior to 1.18.4
Bundled libxslt versions prior to 1.1.43
Ruby applications using Nokogiri for XSLT transformation

Discovery Timeline

2026-08-25 - CVE-2025-71406 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2025-71406

Vulnerability Analysis

CVE-2025-71406 is a use-after-free issue [CWE-416] rooted in the libxslt library that Nokogiri statically bundles. Two distinct upstream flaws compose the risk. CVE-2025-24855 is a use-after-free of the XPath context node because xsltEvalXPathStringNs leaks xpathCtxt->node. CVE-2024-55549 is a separate use-after-free tied to how excluded result prefixes and namespaces are handled during transformation.

An attacker who controls XSLT input processed by a vulnerable Nokogiri build can trigger dangling pointer dereferences during stylesheet evaluation. The result is memory corruption inside the host process, which can cause crashes, data corruption, or exploitation paths leading to arbitrary code execution.

Root Cause

The root cause lies in libxslt prior to 1.1.43. In the XPath evaluation path, xsltEvalXPathStringNs retains a pointer to a context node whose backing memory has already been released. In the excluded-result-prefix path, namespace bookkeeping frees objects that later code paths still reference. Both patterns are classic use-after-free defects.

Attack Vector

Exploitation requires an attacker-supplied or attacker-influenced XSLT stylesheet processed by a Nokogiri-based application. The attack is network reachable when applications accept XSLT, XML with embedded transforms, or documents that trigger stylesheet processing from untrusted sources. No authentication or user interaction is required if the endpoint accepts untrusted transformation input.

See the GitHub Security Advisory GHSA-mrxw-mxhj-p664 and the VulnCheck Nokogiri Use After Free Advisory for technical detail.

Detection Methods for CVE-2025-71406

Indicators of Compromise

Unexpected crashes or segmentation faults in Ruby processes performing XSLT transformations via Nokogiri
Presence of Nokogiri gem versions below 1.18.4 in application dependency manifests (Gemfile.lock, container images)
Inbound requests containing crafted xsl:stylesheet elements or unusual xsl:exclude-result-prefixes declarations

Detection Strategies

Inventory installed Ruby gems and flag any nokogiri < 1.18.4 deployments across production and build environments.
Inspect application logs and crash reporters for repeated aborts in the libxslt code path or during Nokogiri::XSLT transform calls.
Use software composition analysis (SCA) tooling to identify transitive dependencies pinning vulnerable Nokogiri releases.

Monitoring Recommendations

Alert on process crashes and core dumps from web workers that process XML or XSLT input.
Monitor egress and telemetry from services accepting user-supplied stylesheets for anomalous behavior after transform operations.
Track dependency updates through CI pipelines to ensure vulnerable Nokogiri versions are not reintroduced.

How to Mitigate CVE-2025-71406

Immediate Actions Required

Upgrade Nokogiri to version 1.18.4 or later in all Ruby applications and container images.
Rebuild and redeploy artifacts that vendor Nokogiri to ensure the bundled libxslt 1.1.43 is in use.
Audit application endpoints that accept XML or XSLT input from untrusted sources and restrict them where possible.

Patch Information

Nokogiri 1.18.4 upgrades the bundled libxslt to 1.1.43, which resolves both CVE-2025-24855 and CVE-2024-55549. Update the gem via bundle update nokogiri and verify the resolved version in Gemfile.lock. Refer to the GitHub Security Advisory GHSA-mrxw-mxhj-p664 for maintainer guidance.

Workarounds

Disable XSLT processing in application code paths that accept untrusted input until the upgrade is applied.
Validate and constrain accepted stylesheets to a known-safe allowlist when transformation cannot be disabled.
Isolate XSLT transformation workers in sandboxed processes with limited privileges to reduce blast radius.

bash

# Configuration example
bundle update nokogiri
bundle list | grep nokogiri
# Verify: nokogiri (>= 1.18.4)