Which versions of Nokogiri are affected by CVE-2025-71406?

Nokogiri versions before 1.18.4 contain a use-after-free vulnerability in XSLT stylesheet processing that could lead to heap corruption and process compromise; no public exploit has been identified…. A patch is available.

How to fix or mitigate CVE-2025-71406?

Within 24 hours, inventory all Ruby applications using Nokogiri and identify which ones process external or untrusted XSLT stylesheets to prioritize remediation. Within 7 days, upgrade Nokogiri to version 1.18.4 or later across all production systems, conduct regression testing in staging environments, and document patch deployment status. Within 30 days, complete patching of all development and non-production environments, update asset inventory records, and implement input validation controls for XSLT stylesheet sources as a defense-in-depth measure.

Nokogiri CVE-2025-71406

Q: What is the CVSS score of CVE-2025-71406?

CVE-2025-71406 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2025-210773 HIGH

Use After Free (CWE-416)

2026-08-25 VulnCheck

GHSA-7jxm-3c74-9v37

Use After Free Buffer Overflow Memory Corruption Nokogiri

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.9 HIGH

AV:N reflects Nokogiri's predominant use in web apps processing external XSLT; AC:H captures use-after-free heap-layout complexity; S:C and I:H/A:H align with upstream libxslt ratings.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 25, 2026 - 17:17 EUVD

Source Code Evidence Fetched

Aug 25, 2026 - 16:01 vuln.today

Analysis Generated

Aug 25, 2026 - 16:01 vuln.today

CVE Published

Aug 25, 2026 - 15:15 cve.org

HIGH 8.7

DescriptionCVE.org

Nokogiri before 1.18.4 bundles a vulnerable version of libxslt (prior to 1.1.43) that contains two use-after-free vulnerabilities: CVE-2025-24855 (use-after-free of the XPath context node due to xsltEvalXPathStringNs leaking xpathCtxt->node) and CVE-2024-55549 (use-after-free related to excluded result prefixes/namespaces). Processing crafted XSLT can trigger memory corruption. Nokogiri 1.18.4 upgrades the bundled libxslt to 1.1.43 to resolve these issues.

AnalysisAI

Use-after-free memory corruption in Nokogiri before 1.18.4 exposes Ruby applications to potential heap corruption and process compromise when processing attacker-supplied XSLT stylesheets. The root cause is Nokogiri's bundled libxslt dependency (prior to v1.1.43), which contains two distinct UAF bugs: CVE-2025-24855 (XPath context node leaked by xsltEvalXPathStringNs) and CVE-2024-55549 (namespace prefix handling corruption). No public exploit code has been identified at time of analysis, and CISA KEV listing is absent; a vendor-released patch (Nokogiri 1.18.4) is available.

Technical ContextAI

Nokogiri is a Ruby gem for parsing HTML and XML that ships a statically bundled copy of libxslt, the GNOME XSLT processing library, rather than relying on the system-provided version. This bundling strategy means Nokogiri carries its own libxslt vulnerability surface independent of OS package updates. The two underlying flaws are classic CWE-416 (Use After Free) defects in libxslt's XSLT evaluation engine: CVE-2025-24855 occurs because xsltEvalXPathStringNs leaks a reference to xpathCtxt->node, allowing it to be freed while still reachable; CVE-2024-55549 corrupts memory in the excluded result prefixes/namespaces code path. Both are triggered by parsing crafted XSLT stylesheets. Affected product is identified via CPE cpe:2.3:a:sparklemotion:nokogiri:*:*:*:*:*:*:*:*, covering all Nokogiri versions prior to 1.18.4 across all platforms.

RemediationAI

Upgrade Nokogiri to version 1.18.4 or later; this is the vendor-confirmed fix (https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-mrxw-mxhj-p664) and upgrades the bundled libxslt to v1.1.43. In most Ruby/Bundler projects this is accomplished with 'bundle update nokogiri' followed by pinning '~> 1.18.4' in the Gemfile. If an immediate upgrade is not possible, a compensating control is to disable or gate any application pathway that accepts XSLT stylesheets from untrusted sources - rejecting externally supplied XSLT at the application boundary eliminates the attack surface without requiring a gem update, though this may break intended functionality for applications that rely on user-supplied transforms. Applications using a system-provided libxslt rather than Nokogiri's bundled copy should verify the system libxslt is at v1.1.43 or newer; if it is, the exposure from this specific vector is mitigated at the OS level.