Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEs

published 2025-03-14 last yr. modified 2026-09-10 2mo ago also CVE-2025-71406

cvss: 7.8; version 3.1, GitHub
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

## Summary

Nokogiri v1.18.4 upgrades its dependency libxslt to [v1.1.43](https://gitlab.gnome.org/GNOME/libxslt/-/releases/v1.1.43).

libxslt v1.1.43 resolves:

- CVE-2025-24855: Fix use-after-free of XPath context node - CVE-2024-55549: Fix UAF related to excluded namespaces

## Impact

### CVE-2025-24855

- "Use-after-free due to xsltEvalXPathStringNs leaking xpathCtxt->node" - MITRE has rated this 7.8 High CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H - Upstream report: https://gitlab.gnome.org/GNOME/libxslt/-/issues/128 - NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2025-24855

### CVE-2024-55549

- "Use-after-free related to excluded result prefixes" - MITRE has rated this 7.8 High CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H - Upstream report: https://gitlab.gnome.org/GNOME/libxslt/-/issues/127 - NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2024-55549

Patch / fix

fixed in 1

rubygems nokogiri 1.18.4

Is GHSA-mrxw-mxhj-p664 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by	version	score	vector
GitHub	3.1	7.8	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
rubygems	nokogiri	<1.18.4	1.18.4

Classification

Weakness

CWE-1395 Dependency on Vulnerable Third-Party Component
CWE-416 Use After Free

References

Sources

GitHub Advisory GHSA-mrxw-mxhj-p664

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.