CVE-2026-79770: Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer
Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Node#css, Node#atcss, and Searchable#search to cause exponential regex backtracking and denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nokogirito a version that resolves this vulnerability.Fixed in 1.19.3 - Compensating control
Avoid processing attacker-controlled CSS selector strings with Nokogiri methods such as Node#css, Node#at_css, and Searchable#search until Nokogiri is updated to 1.19.3.
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Applications using Nokogiri before 1.19.3 are exposed when they pass attacker-controlled CSS selector strings to Node#css, Node#at_css, or Searchable#search. The impact is denial of service through excessive regular-expression backtracking.
Does exploitation require authentication or user interaction?
No. The supplied severity vector indicates network access, low attack complexity, no privileges required, and no user interaction.
What version resolves the vulnerability?
Upgrade Nokogiri to version 1.19.3 or later. The affected versions are those before 1.19.3.