Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::NodeSet#[] (and its alias #slice) checked the requested index against the node set's bounds using a 32-bit-truncated copy of the index. A large negative index could pass the check and then be used at full width, reading outside the node set's storage. On CRuby this is an out-of-bounds read that typically crashes the process; on JRuby it is not memory-unsafe but returns an incorrect node. This vulnerability is fixed in 1.19.4.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
Nokogiri (Ruby's XML/HTML parser) just patched CVE-2026-57235: integer truncation in NodeSet indexing. If you're running Rails or any Ruby app that parses XML, here's what to check Saturday.
Post summary
The tweet announces that Nokogiri has patched CVE‑2026‑57235, an integer truncation flaw in NodeSet indexing, for Ruby applications parsing XML.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | nokogiri | nokogiri | - | ruby | - |