NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
💎
💎 RubyGems
Not in CISA KEV
HIGH severity

Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEsGHSA-mrxw-mxhj-p664

HIGH

GHSA-mrxw-mxhj-p664 is a high-severity (CVSS 7.8) vulnerability in nokogiri. A fix is available for nokogiri — see the affected versions and patch details below.

Also known asCVE-2025-71406
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Sep 10, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
💎nokogiri

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.

Description

Summary

Nokogiri v1.18.4 upgrades its dependency libxslt to v1.1.43.

libxslt v1.1.43 resolves:

  • CVE-2025-24855: Fix use-after-free of XPath context node
  • CVE-2024-55549: Fix UAF related to excluded namespaces

Impact

CVE-2025-24855

CVE-2024-55549

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
💎RubyGemsnokogiriall versions1.18.4bundle update nokogiri --conservative

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for nokogiri, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update nokogiri to 1.18.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-mrxw-mxhj-p664 is resolved across your whole dependency graph.

  3. Workarounds

    Constrain what reaches the vulnerable code: limit the size and shape of untrusted input, isolate the affected component in a sandboxed or least-privileged process, and enable the platform's memory-safety mitigations (ASLR, stack protector, hardened allocator) so an out-of-bounds access is more likely to fail closed than to be exploitable.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant

This is an Important vulnerability. Red Hat products bundling Nokogiri versions prior to 1.18.4 are affected by use-after-free flaws in the integrated libxslt library. Processing specially crafted XSLT input could lead to memory corruption, potentially allowing for remote code execution or denial of service in…

Workaround published by Red Hat
To reduce the risk associated with this vulnerability, ensure that applications using Nokogiri do not process untrusted Extensible Stylesheet Language Transformations (XSLT) input. Implement strict input validation and only allow XSLT from trusted sources.
Source: Red Hat security advisory for GHSA-mrxw-mxhj-p664 (CC BY 4.0)
ProductFixed inAdvisory
Red Hat Hardened Imageslibxslt-main-1.1.45-0.1.1.hum1RHSA-2026:41276

Frequently Asked Questions

## Summary Nokogiri v1.18.4 upgrades its dependency libxslt to [v1.1.43](https://gitlab.gnome.org/GNOME/libxslt/-/releases/v1.1.43). libxslt v1.1.43 resolves: - CVE-2025-24855: Fix use-after-free of XPath context node - CVE-2024-55549: Fix UAF related to excluded namespaces ## Impact ### CVE-2025-24855 - "Use-after-free due to xsltEvalXPathStringNs leaking xpathCtxt->node" - MITRE has rated this 7.8 High CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H - Upstream report: https://gitlab.gnome.org/GNOME/libxslt/-/issues/128 - NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2025-24855 ### CVE-
O3 Security · Impact-Aware SCA

Is GHSA-mrxw-mxhj-p664 in your dependencies?

Find it across RubyGems, including transitive dependencies.

Scan my dependencies How O3 SCA works