CVE-2026-57235
High
Description
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::NodeSet#[] (and its alias #slice) checked the requested index against the node set's bounds using a 32-bit-truncated copy of the index. A large negative index could pass the check and then be used at full width, reading outside the node set's storage. On CRuby this is an out-of-bounds read that typically crashes the process; on JRuby it is not memory-unsafe but returns an incorrect node. This vulnerability is fixed in 1.19.4.
SeverityHigh
CVSS8.2
Exploit probability—
ProductNokogiri
PublishedJun 25, 2026
First seenJun 25, 2026
Weakness typeCWE-125Out-of-bounds readCWE-190Integer overflow
How to fix
Update
- nokogiri nokogiri1.19.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nokogiri nokogiri | v < 1.19.4 | 1.19.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.