CVE-2026-57235: Nokogiri NodeSet Out-of-Bounds Read Vulnerability (v1.19.4)

Technical summary

CVE-2026-57235 exploits a bounds-checking logic error in Nokogiri::XML::NodeSet#[] and its alias #slice. The vulnerability stems from a 32-bit-truncated copy of the requested index used during bounds validation. A sufficiently large negative index (one that fits within 32 bits when truncated but extends beyond that when interpreted as a full-width signed integer) can bypass the bounds check. The unchecked index is then dereferenced at full width, causing an out-of-bounds memory read. The root causes are CWE-125 (out-of-bounds read) and CWE-190 (integer overflow/underflow). Impact varies by Ruby implementation: CRuby experiences memory safety violations typically resulting in process termination; JRuby lacks memory unsafety but returns semantically incorrect nodes.

Business impact

Applications using Nokogiri to parse untrusted or attacker-controlled XML/HTML documents face denial-of-service risk through process crashes on CRuby platforms. For JRuby deployments, the silent return of incorrect nodes could lead to data misinterpretation, potentially affecting business logic that relies on accurate DOM traversal. Supply-chain risk is significant given Nokogiri's popularity in Ruby ecosystems for web scraping, API integrations, and document processing. Affected organizations should prioritize inventory and testing of dependent applications.

Affected systems

Nokogiri versions prior to 1.19.4 are affected. The vulnerability impacts any Ruby application (CRuby or JRuby) that uses Nokogiri and calls the [] or slice method on a NodeSet with user-influenced or computed indices. Indirect exposure exists in applications that depend on gems that transitively require vulnerable Nokogiri versions.

Exploitability

Exploitation requires the ability to influence the index parameter passed to NodeSet#[] or #slice. In web applications parsing user-supplied XML/HTML or in APIs accepting index-like parameters, this is trivially achievable without authentication or special privileges. No user interaction is required. The attack surface is broad for any Nokogiri-based document processor handling external input. However, weaponization depends on predictable memory layout to achieve reliable denial-of-service; gaining code execution or arbitrary information disclosure is not demonstrated by this vulnerability alone.

Remediation

Upgrade Nokogiri to version 1.19.4 or later. For Ruby projects, update the gem dependency in Gemfile or gemspec and run bundle update nokogiri. Verify the updated version using bundle show nokogiri or gem list. Projects unable to upgrade immediately should implement input validation on indices before passing them to NodeSet methods, or restrict access to document parsing endpoints.

Patch guidance

Apply the upgrade to Nokogiri 1.19.4 or higher across all Ruby environments (development, staging, production). Automated dependency scanning tools (Dependabot, Snyk, Bundler Audit) can identify affected versions in your codebase. Test the upgrade in a staging environment to ensure compatibility with your application, particularly if custom code wraps or extends NodeSet behavior. Verify against the official Nokogiri release notes and GitHub repository for any breaking changes or additional security notes.

Detection guidance

Use Software Composition Analysis (SCA) tools to scan Ruby project dependencies and identify Nokogiri versions below 1.19.4. Check Gemfile.lock for the installed version. Monitor application logs for unexpected crashes or exceptions originating from Nokogiri parsing routines, which may indicate exploitation attempts. Network-based detection is limited; detection focuses on inventory and runtime monitoring rather than network signatures.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score (8.2), ease of exploitation (network-accessible, no authentication required), and ubiquity of Nokogiri in Ruby applications. The availability impact (process crash on CRuby) combined with potential information disclosure makes it a significant operational risk. Prioritize remediation for internet-facing services and applications processing untrusted documents.

Risk score, explained

The CVSS v3.1 score of 8.2 reflects a network-accessible attack vector, low complexity, no privilege or user interaction required, and high availability impact. The confidentiality impact is rated low (out-of-bounds read may leak some data but is limited) while integrity is unaffected. The score appropriately reflects the denial-of-service and information disclosure concerns, though the actual impact depends on memory layout and Ruby implementation.

Frequently asked questions