CVE-2025-71406 in Nokogiri
Summary
by MITRE • 08/25/2026
Nokogiri before 1.18.4 bundles a vulnerable version of libxslt (prior to 1.1.43) that contains two use-after-free vulnerabilities: CVE-2025-24855 (use-after-free of the XPath context node due to xsltEvalXPathStringNs leaking xpathCtxt->node) and CVE-2024-55549 (use-after-free related to excluded result prefixes/namespaces). Processing crafted XSLT can trigger memory corruption. Nokogiri 1.18.4 upgrades the bundled libxslt to 1.1.43 to resolve these issues.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
Nokogiri versions prior to 1.18.4 are affected by critical security vulnerabilities stemming from a bundled version of the libxslt library that predates release 1.1.43. This dependency issue introduces two distinct use-after-free flaws, identified as CVE-2025-24855 and CVE-2024-55549, which compromise memory safety during XML transformation operations. The root cause lies in the improper management of memory resources within the underlying C library used by Nokogiri to process Extensible Stylesheet Language Transformations. When an application utilizes these older versions of libxslt through Nokogiri, it inherits vulnerabilities that allow for unauthorized access to freed memory regions, potentially leading to arbitrary code execution or denial of service conditions depending on how the corrupted memory is utilized by the attacker.
The first vulnerability, CVE-2025-24855, involves a use-after-free condition related to the XPath context node. Specifically, during the evaluation of an XPath string with namespace support via the xsltEvalXPathStringNs function, the implementation fails to properly nullify or manage the xpathCtxt->node pointer after it has been freed. This oversight means that subsequent operations may attempt to dereference a memory address that no longer belongs to the application's valid heap space. In the context of CWE classifications, this aligns with CWE-416, Use After Free, where software continues to use pointers to free memory without proper validation or reassignment. An attacker can exploit this by crafting specific XPath expressions within an XSLT stylesheet that trigger the premature deallocation of the node while maintaining a reference to it for later access.
The second vulnerability, CVE-2024-55549, pertains to use-after-free errors associated with excluded result prefixes and namespaces during XML transformation processing. When Nokogiri processes an XSLT document that defines exclusions for certain namespace prefixes or URIs in the output, libxslt may incorrectly handle the internal data structures representing these exclusions. If memory is freed while references to these exclusion lists remain active within the transformation context, subsequent operations can access invalid memory locations. This flaw also falls under CWE-416 and represents a significant risk because it allows for potential heap corruption or information disclosure if the attacker can control the content of the freed memory region through carefully crafted input data.
The operational impact of these vulnerabilities is severe for any application that processes untrusted XML documents containing XSLT stylesheets using affected versions of Nokogiri. An adversary who can supply maliciously constructed XSLT files to a vulnerable service could trigger these use-after-free conditions, leading to memory corruption. Depending on the execution environment and compiler protections such as Address Space Layout Randomization or stack canaries, this may result in application crashes causing denial of service, or more critically, arbitrary code execution with the privileges of the process running Nokogiri. This is particularly dangerous in web applications where XML parsing services are exposed to external users, as it provides a direct path for remote exploitation without requiring authentication if input validation is insufficient.
From an attack perspective, these vulnerabilities facilitate techniques categorized under MITRE ATT&CK ID T1203, Exploitation for Client Execution, or potentially T1059, Command and Scripting Interpreter, depending on the payload delivered via memory corruption. The ability to manipulate heap memory allows attackers to overwrite function pointers or return addresses, effectively hijacking control flow within the application process. This underscores the importance of treating all XML input as untrusted and ensuring that parsing libraries are kept up to date with security patches provided by upstream maintainers like libxslt.
To mitigate these risks, organizations must upgrade Nokogiri to version 1.18.4 or later immediately upon availability in their respective package repositories. This update incorporates the patched version of libxslt (1.1.43) which resolves both CVE-2025-24855 and CVE-2024-55549 by correcting the memory management logic for XPath contexts and namespace exclusions. For environments where immediate upgrading is not feasible, implementing strict input validation to reject XSLT stylesheets from untrusted sources can reduce the attack surface. Additionally, enabling runtime application self-protection mechanisms or using sandboxing techniques may help contain potential exploits until a permanent fix is deployed. Regular auditing of gem dependencies and adherence to secure coding practices that minimize trust in external XML inputs are essential steps in maintaining robust security posture against such memory corruption vulnerabilities.