CVE-2026-79770
Received Received - Intake

Nokogiri Regex DoS in CSS Selector Tokenizer

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Node#css, Node#at_css, and Searchable#search to cause exponential regex backtracking and denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-79770
EUVD
EUVD-2026-65528

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sparklemotion nokogiri to 1.19.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1333 The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Nokogiri before 1.19.3 has regex denial of service flaws in CSS selector parsing. Attackers can inject malicious CSS selectors into methods like Node#css or Searchable#search to trigger exponential backtracking, consuming excessive CPU and causing service disruption.

Detection Guidance

Check Nokogiri version with gem list nokogiri. If version is before 1.19.3, the system is vulnerable. Monitor CPU usage spikes during CSS selector processing as a potential indicator of exploitation.

Impact Analysis

This vulnerability allows remote attackers to cause high CPU usage and system slowdowns or crashes by sending specially crafted CSS selectors. It requires no privileges or user interaction, making it easy to exploit.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it primarily causes denial of service through excessive CPU consumption. However, denial of service conditions could impact availability of systems processing regulated data, potentially violating availability requirements in GDPR Article 32 or HIPAA Security Rule standards.

Mitigation Strategies

Upgrade Nokogiri to version 1.19.3 or later. Avoid using attacker-controlled text in CSS selectors. Set a global Regexp.timeout in supported Ruby versions to limit regex processing time.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79770. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart