Executive brief
Nokogiri is a widely-used Ruby library for parsing and manipulating XML and HTML documents. The library's CSS selector parser contains inefficient regular expressions that can cause exponential computational backtracking when processing adversarial CSS selectors. An attacker who can control CSS selector input (e.g., through user-supplied text in web applications) can trigger a denial of service by exhausting server CPU resources.
Technical details
The vulnerability exists in Nokogiri's CSS selector tokenizer, which uses regular expressions to parse CSS selectors. Three distinct ReDoS vectors were identified: (1) string-literal tokenization on unterminated quoted-string input, (2) string-literal tokenization on hex-escape-rich input, and (3) identifier tokenization on hex-escape-rich input. These regexes exhibit exponential worst-case complexity due to excessive backtracking behavior. The affected public methods include Nokogiri::CSS.xpath_for, Node#css, Node#at_css, Searchable#search, and CSS::Parser#parse. Attack vectors require network accessibility (for applications that process user-supplied CSS selectors) and no authentication or privileges. Exploitation causes CPU exhaustion leading to denial of service. The vulnerability is fixed in Nokogiri version 1.19.3 and later. Workarounds include avoiding user-controlled input in CSS selectors and setting Regexp.timeout on Ruby 3.2+ or JRuby 9.4+.
Affected products
- sparklemotion Nokogiri < 1.19.3
Timeline
- 2026-04-27: disclosed
- 2026-04-27: patched: Version 1.19.3 released with fixes