CVE-2026-79770: Nokogiri CSS selector tokenizer regular expression DoS

CVE-2026-79770 · Severity: high · CVSS 7.5 · Published 2026-08-25

Nokogiri is a widely-used Ruby library for parsing and manipulating XML and HTML documents. Its CSS selector feature contains regular expressions that can be forced into exponential backtracking loops when processing specially crafted selectors. An attacker able to inject malicious CSS selectors—such as through a web form or API accepting user input—can cause the application to hang or consume excessive CPU, resulting in a denial of service and disrupting service availability to legitimate users.

Technologies: nokogiri (RubyGems). Vendors: RubyGems.

Quick answers

Is CVE-2026-79770 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-79770 being exploited in the wild.
How severe is CVE-2026-79770?
High severity, with a CVSS score of 7.5, published 25 August 2026.
Which products and versions are affected?
nokogiri (RubyGems) < 1.19.3, ECOSYSTEM:introduced=0,fixed=1.19.3.
Is there a fix for CVE-2026-79770?
Yes. nokogiri (RubyGems): upgrade to 1.19.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79770 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-79770?
Check whether you run nokogiri (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nokogiri (RubyGems): upgrade to 1.19.3 or later
    bundle update nokogiri

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) affecting Nokogiri's CSS selector tokenizer. Three distinct ReDoS vectors were identified: (1) unterminated quoted-string input in string-literal tokenization, (2) hex-escape-rich input in string-literal tokenization, and (3) hex-escape-rich input in identifier tokenization. The affected public methods include Nokogiri::CSS.xpath_for, Node#css, Node#at_css, Searchable#search, and CSS::Parser#parse. An unauthenticated network attacker can inject adversarial CSS selectors to trigger exponential regex backtracking, consuming CPU and causing denial of service. No authentication or user interaction is required. The vulnerability is patched in Nokogiri 1.19.3 and later; affected versions are &lt; 1.19.3. Workarounds include avoiding attacker-controlled CSS selectors or setting global Regexp.timeout on Ruby 3.2+ and JRuby 9.4+.

Affected products

  • Sparklemotion Nokogiri < 1.19.3

Identifiers

  • CVE-2026-79770
  • GHSA-c4rq-3m3g-8wgx

Timeline

  • 2026-04-27: disclosed: Advisory published by Nokogiri maintainers
  • 2026-04-27: patched: Version 1.19.3 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.