CVE-2026-57234

Name of the Vulnerable Software and Affected Versions Nokogiri versions prior to 1.19.4

Description In the JRuby implementation, the NONET parse option—enabled by default for Nokogiri::XML::Schema—was not correctly enforced. This allows a schema parsed with default options to fetch external resources over the network, which could lead to Server-Side Request Forgery (SSRF) or XML External Entity (XXE) attacks. SSRF is a technique where an attacker induces a server to make requests to an unintended location, and XXE is an attack that interferes with an application's processing of XML input.

Recommendations Update to version 1.19.4.