Executive brief
Nokogiri is a widely-used Ruby library for parsing and manipulating XML and HTML documents. Its CSS selector feature contains regular expressions that can be forced into exponential backtracking loops when processing specially crafted selectors. An attacker able to inject malicious CSS selectors—such as through a web form or API accepting user input—can cause the application to hang or consume excessive CPU, resulting in a denial of service and disrupting service availability to legitimate users.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) affecting Nokogiri's CSS selector tokenizer. Three distinct ReDoS vectors were identified: (1) unterminated quoted-string input in string-literal tokenization, (2) hex-escape-rich input in string-literal tokenization, and (3) hex-escape-rich input in identifier tokenization. The affected public methods include Nokogiri::CSS.xpath_for, Node#css, Node#at_css, Searchable#search, and CSS::Parser#parse. An unauthenticated network attacker can inject adversarial CSS selectors to trigger exponential regex backtracking, consuming CPU and causing denial of service. No authentication or user interaction is required. The vulnerability is patched in Nokogiri 1.19.3 and later; affected versions are < 1.19.3. Workarounds include avoiding attacker-controlled CSS selectors or setting global Regexp.timeout on Ruby 3.2+ and JRuby 9.4+.
Affected products
- Sparklemotion Nokogiri < 1.19.3
Timeline
- 2026-04-27: disclosed: Advisory published by Nokogiri maintainers
- 2026-04-27: patched: Version 1.19.3 released with fix
References
- https://api.github.com/users/colby-swandale
- https://github.com/colby-swandale
- https://api.github.com/users/colby-swandale/gists%7B/gist_id%7D
- https://api.github.com/users/colby-swandale/repos
- https://avatars.githubusercontent.com/u/996377?v=4
- https://api.github.com/users/colby-swandale/events%7B/privacy%7D