RubyGems/nokogiri CVE-2026-57234: low 2.6, EPSS 0.20%

Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247

Action: Upgrade nokogiri to 1.19.4 or later.

bundle update nokogiri

Affected

Fixed versions

Sources

• osv: GHSA-8678-w3jw-xfc2
• https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-8678-w3jw-xfc2
• https://github.com/sparklemotion/nokogiri

CVE-2026-57234 · published 2026-06-19T16:36:11Z · modified 2026-09-10T03:51:08.233410080Z · JSON