CVE-2026-79770 in Nokogiri
Summary
by MITRE • 08/25/2026
Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Node#css, Node#at_css, and Searchable#search to cause exponential regex backtracking and denial of service.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified in Nokogiri versions prior to 1.19.3 represents a significant regular expression denial of service (ReDoS) risk embedded within the library's CSS selector tokenizer. This flaw specifically impacts the processing of string-literal and identifier tokens during the parsing phase of Cascading Style Sheet selectors. When an application utilizes methods such as Node#css, Node#at_css, or Searchable#search to query HTML or XML documents using complex or maliciously crafted CSS selectors, the underlying regular expression engine may encounter patterns that trigger exponential backtracking. This behavior occurs because certain regex constructs can evaluate a vast number of potential matches before determining that no valid match exists, leading to excessive CPU consumption and eventual service unavailability for the host application.
From a technical perspective, this issue stems from catastrophic backtracking within the regular expressions used to tokenize CSS identifiers and string literals. Regular expression engines typically use a non-deterministic finite automaton approach or similar mechanisms that can revisit states when a match fails later in the pattern. In the context of Nokogiri's tokenizer, specific sequences of characters in adversarial selectors create ambiguity in how tokens are recognized. As the input length increases, the time required to resolve these ambiguaries grows exponentially rather than linearly. This allows an attacker who controls or influences the CSS selector input to craft payloads that force the parser into a state where it performs millions or billions of unnecessary computational steps before timing out or crashing, effectively creating a denial of service condition without requiring elevated privileges or authentication in many web-facing scenarios.
The operational impact of this vulnerability is severe for any application relying on Nokogiri for document parsing and querying. Since CSS selectors are commonly used to extract specific data from HTML structures, they are frequently derived from user input or configuration files that may not be fully sanitized before being passed to the parser. An attacker can exploit this by submitting a specially crafted query string through an API endpoint, web form, or any interface where Nokogiri is invoked with dynamic selector strings. The resulting resource exhaustion can lead to application crashes, increased latency for legitimate users, and potential cascading failures in systems that depend on real-time data retrieval from HTML sources. This aligns with the Common Weakness Enumeration category CWE-400, which covers uncontrolled resource consumption due to regular expression complexity, and is often associated with ATT&CK technique T1496, Resource Hijacking, where attackers consume system resources to disrupt service availability.
Mitigation strategies for this vulnerability primarily involve upgrading Nokogiri to version 1.19.3 or later, which includes patches that optimize the regex patterns and prevent exponential backtracking scenarios. For environments where an immediate upgrade is not feasible, developers should implement strict input validation on all CSS selector strings before they are passed to Nokogiri methods. This includes limiting the length of selectors, restricting allowed character sets, and avoiding complex nested structures in user-supplied queries. Additionally, implementing timeout mechanisms for parsing operations can provide a secondary layer of defense by terminating long-running regex evaluations before they exhaust system resources. Regular security audits of codebases using Nokogiri are recommended to identify any instances where dynamic CSS selectors are constructed from untrusted sources, ensuring that the application remains resilient against such resource exhaustion attacks.