GHSA-mrxw-mxhj-p664 — nokogiri
HIGHGHSA-mrxw-mxhj-p664 is a high-severity (CVSS 7.8) vulnerability in nokogiri. A fix is available for nokogiri — see the affected versions and patch details below.
Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEs
Real-World Exposure
nokogiriReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.
Description
Summary
Nokogiri v1.18.4 upgrades its dependency libxslt to v1.1.43.
libxslt v1.1.43 resolves:
- CVE-2025-24855: Fix use-after-free of XPath context node
- CVE-2024-55549: Fix UAF related to excluded namespaces
Impact
CVE-2025-24855
- "Use-after-free due to xsltEvalXPathStringNs leaking xpathCtxt->node"
- MITRE has rated this 7.8 High CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
- Upstream report: https://gitlab.gnome.org/GNOME/libxslt/-/issues/128
- NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2025-24855
CVE-2024-55549
- "Use-after-free related to excluded result prefixes"
- MITRE has rated this 7.8 High CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
- Upstream report: https://gitlab.gnome.org/GNOME/libxslt/-/issues/127
- NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2024-55549
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 💎RubyGems | nokogiri | all versions | 1.18.4bundle update nokogiri --conservative |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for nokogiri, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update nokogiri to 1.18.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-mrxw-mxhj-p664 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-mrxw-mxhj-p664 can be triaged on real exposure rather than presence alone.
Tailored to GHSA-mrxw-mxhj-p664. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
This is an Important vulnerability. Red Hat products bundling Nokogiri versions prior to 1.18.4 are affected by use-after-free flaws in the integrated libxslt library. Processing specially crafted XSLT input could lead to memory corruption, potentially allowing for remote code execution or denial of service in…
| Product | Fixed in | Advisory |
|---|---|---|
| Red Hat Hardened Images | libxslt-main-1.1.45-0.1.1.hum1 | RHSA-2026:41276 |
Frequently Asked Questions
Is GHSA-mrxw-mxhj-p664 in your dependencies?
O3 Security finds GHSA-mrxw-mxhj-p664 across RubyGems dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.