CVE-2026-79770 Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer
Attackers can cause denial of service in applications using Nokogiri by injecting malicious CSS selectors that trigger exponential regex backtracking.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-79770?
CVE-2026-79770 is a high-severity denial of service vulnerability in sparklemotion nokogiri, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Node#css, Node#at_css, and Searchable#search to cause exponential regex backtracking and denial of service.
Weakness: CWE-1333
Which versions are affected by CVE-2026-79770?
2 open source packages ship an affected version, including nokogiri. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nokogiri RubyGems | All versions | 1.19.3 |
nokogiri RubyGems | All versions | 1.19.3 |
Products include Nokogiri Nokogiri.
How do I fix CVE-2026-79770?
Upgrade nokogiri to 1.19.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-79770 being exploited?
There is no known exploitation of CVE-2026-79770 in the wild and no public exploit code.
Other vulnerabilities in sparklemotion nokogiri
- CVE-2022-23476 Unchecked return value from xmlTextReaderExpand in Nokogiri
- CVE-2021-41098 Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby
- CVE-2012-6685 Nokogiri is vulnerable to XML External Entity (XXE) attack
- CVE-2026-79771 Nokogiri before 1.19.3 Memory Leak via XSLT Transform
- CVE-2026-79772 Nokogiri before 1.19.1 Unchecked Return Value canonicalize
Sources
Also known as BELL-CVE-2026-79770, DEBIAN-CVE-2026-79770, GHSA-c4rq-3m3g-8wgx, MINI-36pc-33wp-6cgv, MINI-65r8-mrv4-mjp3, MINI-69gm-jxwf-2m94 and 7 more.