CVE-2026-57235 describes an out-of-bounds read vulnerability in the Nokogiri library for Ruby, specifically in the NodeSet indexing methods (#[] and #slice). The vulnerability arises because the index is checked against the node set bounds using a 32-bit truncated copy, allowing a large negative index to pass the check but then be used at full width, resulting in reading memory outside the intended storage. This leads to process crashes on CRuby and incorrect node returns on JRuby. The issue is resolved in Nokogiri version 1.19.4.

On CRuby, exploitation of this vulnerability typically causes a process crash due to out-of-bounds memory reads. On JRuby, it does not cause memory corruption but returns incorrect data, potentially leading to application logic errors. There is no indication of remote code execution or privilege escalation. The CVSS 4.0 score is 6.3 (medium severity), reflecting a network attack vector with low complexity and partial attack prerequisites.

Upgrade Nokogiri to version 1.19.4 or later, where this vulnerability is fixed. No other mitigation is indicated or required.