Nokogiri out-of-bounds read in XML NodeSet

Executive brief

Nokogiri, a popular Ruby library for processing XML and HTML, contains a vulnerability in how it handles specific data requests. An attacker could provide a specially crafted large number to the library, causing the application to crash or potentially leak small amounts of memory. This could lead to a service outage for applications that process untrusted user input using this library.

Technical details

An out-of-bounds read vulnerability exists in `Nokogiri::XML::NodeSet#[]` and its alias `#slice`. The root cause is an integer truncation issue where the library performs bounds checking using a 32-bit-truncated copy of the requested index, but subsequently uses the full-width index to access memory. A large negative index can bypass the bounds check, allowing an attacker to read memory outside the node set's allocated storage. On CRuby, this typically results in a process crash (DoS) or potential memory disclosure; JRuby is not memory-unsafe but may return incorrect data. The vulnerability is reachable if an application passes attacker-controlled integers to the affected methods. This issue is resolved in Nokogiri version 1.19.4.

Affected products

• sparklemotion Nokogiri < 1.19.4

Timeline

• 2026-06-18: disclosed
• 2026-06-19: advisory
• 2026-06-19: patched: Fixed in version 1.19.4

References

• https://api.github.com/users/cla7aye15I4nd
• https://github.com/cla7aye15I4nd
• https://api.github.com/users/cla7aye15I4nd/gists%7B/gist_id%7D
• https://api.github.com/users/cla7aye15I4nd/repos
• https://avatars.githubusercontent.com/u/17133261?v=4
• https://api.github.com/users/cla7aye15I4nd/events%7B/privacy%7D