CVE-2025-71406

A vulnerability in the Nokogiri library affects the `Nokogiri::XML::NodeSet#[]` method (and its alias `#slice`). The index check against the node set's bounds used a 32-bit-truncated copy of the index, allowing a large negative index to pass the check and then be used at full width, reading outside the node set's storage.

A vulnerability in the Nokogiri library allows calling `Document#encoding=` with an invalid encoding (e.g., a non-string or a string containing a null byte), which frees the document's current encoding string without replacing it. The document is left referencing freed memory, leading to a use-after-free condition on the next call.

The vulnerability in the Nokogiri library for JRuby causes the NONET option to be incorrectly enforced when parsing XML schemas. This allows an attacker to load external network resources, potentially leading to data leakage or SSRF attacks.

Nokogiri has a bug in methods called on allocated-but-uninitialized native wrapper classes inheriting from `Nokogiri::XML::Node`. This causes a NULL pointer dereference that could crash the process.

The vulnerability in the Nokogiri library causes `Nokogiri::XML::XPathContext` to not keep its source document alive for garbage collection. If an XPathContext outlives its document and the document is collected, evaluating an XPath expression could read invalid memory and potentially segfault.

Nokogiri's CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, `Nokogiri::XML::Attr#value=` could free the underlying native child node while the wrapper remains.

A vulnerability in the Nokogiri library allows a DTD node to be set as the document root, leading to a heap use-after-free during garbage collection or finalization. This results in an invalid memory read or potentially a segfault.

The vulnerability in the Nokogiri library affects the `Nokogiri::XML::Node#do_xinclude` method, which during XInclude processing removes `<xi:include>` nodes along with their children (e.g., `<xi:fallback>`) and declared namespaces. If an application previously accessed these nodes, unexpected behavior may occur.

The vulnerability in the Nokogiri library affects the protected copy helper used by Node#dup and #clone methods. It unwrapped the source argument as an xmlNode without a type check, causing an out-of-bounds read on xmlNs structure and process crash when a non-Node object (e.g. Namespace) was supplied. Version 1.19.4 adds a type check and raises TypeError.

Nokogiri before 1.18.3 contains a stack buffer overflow vulnerability in libxml2 when reporting DTD validation errors with long QName prefixes, and a use-after-free vulnerability during validation against untrusted XML Schemas. Attackers can trigger these vulnerabilities by providing malicious DTD content or untrusted XSD files to cause denial of service or potential code execution.