NOKOGIRI · CVE-2026-126062 · Package
FIX → 1.19.5
On JRuby, Nokogiri's NONET parse option fails to block external DTDs and entities whose system identifier uses a short-form IPv4 host or an absolute path. An application that parses untrusted XML with DTDLOAD, DTDVALID or NOENT can be made to send network requests, enabling SSRF.
first public Nov 2, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only applications running Nokogiri on JRuby are affected; the advisory states default parse options are not affected. The risk requires parsing untrusted XML with DTDLOAD, DTDVALID or NOENT enabled, so teams that only parse trusted XML or keep defaults can skip it.
Not affected if default-config, mri-ruby, trusted-input-only
Who cares jruby, nokogiri, ruby
nokogiri and confirm whether it is below 1.19.5.DTDLOAD, DTDVALID or NOENT on untrusted input.Upgrade to 1.19.5
On JRuby, the NONET parse option did not block an external DTD or entity whose system identifier used a short-form IPv4 host, such as http://127.1/ or http://169.254.43518/, or was an absolute path such as /x.dtd in a document parsed from a network URL. An application that parses untrusted XML with DTDLOAD, DTDVALID or NOENT could be made to send network requests, potentially enabling SSRF.
Nokogiri 1.19.5 applies the XML::Schema check from GHSA-8678-w3jw-xfc2: with NONET set, only local resources are loaded.
Only JRuby is affected. Default parse options are not affected.
The Nokogiri maintainers have evaluated this as low severity.
Upgrade to Nokogiri 1.19.5 or later, or do not enable , or for untrusted input.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
1.19.5 or later.DTDLOAD, DTDVALID or NOENT for untrusted input.DTDLOADDTDVALIDNOENTThis issue was responsibly reported by @arpitjain099.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain · GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.