Server-Side Request Forgery Vulnerability in Nokogiri Library

CVE-2026-126062

What is CVE-2026-126062?

Nokogiri, an open-source XML and HTML library for Ruby, is affected by a vulnerability that allows applications using JRuby to bypass the NONET restriction when parsing untrusted XML. This occurs specifically with the DTDLOAD, DTDVALID, or NOENT features when an external DTD or entity uses a short-form IPv4 host or absolute paths resolved against a network URL. As a result, untrusted references may be treated as local, enabling malicious actors to issue unauthorized network requests, commonly referred to as server-side request forgery. This issue is mitigated in version 1.19.5 of the Nokogiri library.

References