CVE-2026-57235

Name of the Vulnerable Software and Affected Versions Nokogiri versions prior to 1.19.4

Description Nokogiri is an open source XML and HTML library for the Ruby programming language. The Nokogiri::XML::NodeSet#[] function (and its alias slice) performs a bounds check on the requested index using a 32-bit-truncated copy. A large negative index can bypass this check and be used at full width, resulting in reading outside the node set's storage. In CRuby, this leads to an out-of-bounds read that typically crashes the process, while in JRuby, it results in the return of an incorrect node.

Recommendations Update Nokogiri to version 1.19.4.