CVE-2026-126062: Nokogiri : Possible SSRF on JRuby when resolving external DTDs or entities with `NONET` set

Q: Which environments are affected?

Affected environments are JRuby applications using Nokogiri versions prior to 1.19.5 that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT enabled. CRuby is not affected.

Q: Are applications using Nokogiri's default parsing options exposed?

No. Default parse options are not affected.

Q: What must an attacker provide to trigger the network request?

The untrusted XML must cause resolution of an external DTD or entity using either a short-form IPv4 host or an absolute path resolved against a network URL. Under those conditions, the resolver may treat the identifier as local despite NONET being set.

Q: How can teams determine whether they need to remediate?

Identify Nokogiri deployments on JRuby that are earlier than version 1.19.5, then review whether they parse untrusted XML with DTDLOAD, DTDVALID, or NOENT. Systems using CRuby or default parse options are not affected.

Q: What is the available fix?

Upgrade Nokogiri to version 1.19.5. If an immediate upgrade is not possible, avoid parsing untrusted XML with DTDLOAD, DTDVALID, or NOENT enabled.

Published Nov 10, 2026

Updated

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a short-form IPv4 host or uses absolute paths resolved against a network URL. The resolver can treat these identifiers as local and send a network request, potentially enabling server-side request forgery. CRuby and default parse options are not affected. This issue is fixed in version 1.19.5.

Affected Software

1 affected component

rubygems/nokogiri<1.19.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Nokogiri to a version that resolves this vulnerability.
Fixed in 1.19.5

Event History

Nov 10, 2026

CVE Published

via MITRE·08:11 PM

Data Sourced

via MITRE·08:11 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which environments are affected?

Affected environments are JRuby applications using Nokogiri versions prior to 1.19.5 that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT enabled. CRuby is not affected.

Are applications using Nokogiri's default parsing options exposed?

No. Default parse options are not affected.

What must an attacker provide to trigger the network request?

The untrusted XML must cause resolution of an external DTD or entity using either a short-form IPv4 host or an absolute path resolved against a network URL. Under those conditions, the resolver may treat the identifier as local despite NONET being set.

How can teams determine whether they need to remediate?

Identify Nokogiri deployments on JRuby that are earlier than version 1.19.5, then review whether they parse untrusted XML with DTDLOAD, DTDVALID, or NOENT. Systems using CRuby or default parse options are not affected.

What is the available fix?

Upgrade Nokogiri to version 1.19.5. If an immediate upgrade is not possible, avoid parsing untrusted XML with DTDLOAD, DTDVALID, or NOENT enabled.

CVE-2026-126062: Nokogiri : Possible SSRF on JRuby when resolving external DTDs or entities with `NONET` set

Affected Software

Remediation

Event History

Frequently Asked Questions

Which environments are affected?

Are applications using Nokogiri's default parsing options exposed?

What must an attacker provide to trigger the network request?

How can teams determine whether they need to remediate?

What is the available fix?

Company

Resources

Contact

Frequently Asked Questions

Which environments are affected?

Are applications using Nokogiri's default parsing options exposed?

What must an attacker provide to trigger the network request?

How can teams determine whether they need to remediate?

What is the available fix?