Ruby on Rails released coordinated security updates for versions 7.2.3.2, 8.0.5.1, and 8.1.3.1 on July 29, 2026. The patches address CVE-2026-66066 by disabling untrusted libvips image loaders at boot, shielding apps that process user-uploaded files from crafted image attacks. Applications handling BMP, ICO, PSD, or similar formats will see variant generation break and must strip those content types from the variable_content_types config. Developers should run bundle update rails immediately and confirm libvips sits at version 8.13 or higher.
Ruby on Rails Ships Urgent Active Storage Security Patch Across All Supported Versions
CVE-2026-66066 hardens libvips integration, but expect broken image variants if you upload BMP, PSD, or other unsupported formats.
Ruby on Rails published three coordinated security updates on July 29, 2026. The patches bump version 7.2 to 7.2.3.2, 8.0 to 8.0.5.1, and 8.1 to 8.1.3.1. All three land within minutes of each other.
Rafael Mendonça França signed the commits with a verified GPG key, and the 8.1 branch actually went live about nine minutes before the others. Probably just CI pipeline timing. The fix targets a single issue in Active Storage: CVE-2026-66066.
What the patch actually does
The vulnerability sits in how libvips handles untrusted image loaders. Applications relying on Active Storage to process user uploads were sitting on a known attack surface. Mike Dalessio wrote the fix, which essentially calls Vips.block_untrusted(true) at application boot. That tells the image processing library to ignore the dangerous format handlers entirely.
It's a clean hardening move. Though it does mean a handful of image formats will no longer play nice with variant transformations.
Applications processing BMP, ICO, PSD, SVG, JPEG XL, JPEG 2000, Netpbm, or FITS files will hit the new restrictions. Attachments and downloads keep working fine. But if you run a background job that tries to generate variants for those formats, expect a Vips::Error.
The workaround is straightforward. You just strip the affected content types from Active Storage's variable list.
Rails.application.config.active_storage.variable_content_types -= %w[ image/bmp image/vnd.microsoft.icon image/vnd.adobe.photoshop ]
Background jobs will catch the failure instead of breaking live requests. If you're already using :mini_magick for processing, your attachment pipeline stays intact. You still need to meet the new minimum library versions, though. libvips needs to sit at 8.13 or higher, and ruby-vips at 2.2.1. Miss those thresholds and Rails will refuse to boot rather than run in an unsecurable state.
How to apply the update
Run bundle update rails and verify the version string. ActiveStorage::VERSION::STRING should return one of the three new numbers depending on your branch. The release notes reference GHSA-xr9x-r78c-5hrm, though the advisory page currently returns a 404. NVD lists CVE-2026-66066 as RESERVED, meaning no CVSS score has been published yet.
The embargo timing suggests coordinated disclosure, which is standard for Rails. This landed well outside the typical weekend window, which tells you the team treated it as urgent. Active Storage processes untrusted uploads across hundreds of thousands of apps. Leaving it exposed while waiting for the next holiday release window just doesn't make sense.
Keep in mind that if you strip ruby-vips from your Gemfile, both the new minimums and the variant restrictions disappear entirely. Not every team will need to make config changes. Organizations accepting user uploads should patch immediately.
Rails 7.2.3.2
Active Support No changes. Active Model No changes. Active Record No changes. Action View No changes. Action Pack No changes. Active Job No changes. Action Mailer No changes.
Rails 8.0.5.1
Active Support No changes. Active Model No changes. Active Record No changes. Action View No changes. Action Pack No changes. Active Job No changes. Action Mailer No changes.
Rails 8.1.3.1
Active Support No changes. Active Model No changes. Active Record No changes. Action View No changes. Action Pack No changes. Active Job No changes. Action Mailer No changes.
