CVE-2026-79770: Nokogiri CSS Selector ReDoS Vulnerability

CVE-2026-79770 Overview

CVE-2026-79770 is a regular expression denial of service (ReDoS) vulnerability in Nokogiri, a widely used Ruby library for parsing HTML and XML. Versions before 1.19.3 contain flawed regular expressions in the CSS selector tokenizer that handle string-literal and identifier tokenization. Attackers can supply crafted CSS selectors to methods including Node#css, Node#at_css, and Searchable#search to trigger exponential regex backtracking. The resulting CPU exhaustion causes the affected Ruby process to hang and stop servicing legitimate requests. The weakness is tracked as [CWE-1333: Inefficient Regular Expression Complexity].

Critical Impact
Remote unauthenticated attackers can send adversarial CSS selectors that consume CPU indefinitely, causing denial of service against any application that parses attacker-influenced selectors with Nokogiri.

Affected Products

Nokogiri Ruby gem versions before 1.19.3
Ruby applications invoking Node#css, Node#at_css, or Searchable#search with untrusted CSS selector input
Web scrapers, HTML/XML processors, and services accepting user-supplied CSS selectors

Discovery Timeline

2026-08-25 - CVE-2026-79770 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-79770

Vulnerability Analysis

Nokogiri implements a CSS-to-XPath translation layer that tokenizes CSS selectors before generating XPath expressions. The tokenizer relies on regular expressions to recognize string literals and identifiers within selector syntax. Certain patterns exhibit catastrophic backtracking when fed inputs that partially match multiple alternatives. When an attacker supplies a crafted selector, the regex engine explores exponential combinations before failing, holding a single CPU core at 100% utilization. A single request can stall a worker for seconds to minutes depending on payload length.

Root Cause

The root cause is inefficient regular expression complexity ([CWE-1333]) in the CSS selector tokenizer. The affected expressions use overlapping quantifiers and alternations on character classes that permit ambiguous matches. Ruby's Onigmo regex engine uses backtracking rather than a linear NFA, so ambiguity in the pattern translates directly to worst-case exponential runtime.

Attack Vector

The attack requires no authentication and no user interaction. Any application path that forwards attacker-controlled data into Nokogiri's CSS selector methods is reachable over the network. Common exposure points include HTML scraping services that accept user-supplied selectors, admin interfaces that expose XPath/CSS query fields, and APIs that transform DOM queries. Because the impact is confined to availability, exploitation does not compromise data confidentiality or integrity, but repeated requests can exhaust an entire worker pool.

A proof-of-concept selector demonstrating the backtracking behavior is described in the GitHub Security Advisory GHSA-c4rq-3m3g-8wgx and the VulnCheck Advisory on Nokogiri. No verified exploit code is reproduced here.

Detection Methods for CVE-2026-79770

Indicators of Compromise

Sustained 100% CPU utilization on Ruby worker processes correlated with inbound HTTP requests containing long or malformed CSS selector strings.
Request timeouts or worker restarts triggered by unusually long-running calls into Nokogiri::CSS, Node#css, or Searchable#search.
HTTP request bodies or query parameters containing repetitive character sequences, nested quotes, or long identifier-like tokens targeting CSS selector inputs.

Detection Strategies

Inventory application dependencies with bundle list nokogiri or gem list nokogiri and flag versions earlier than 1.19.3.
Instrument Nokogiri call sites with per-call timing and log any selector evaluation exceeding a configured threshold such as 250ms.
Add web application firewall rules that inspect request parameters for selector payloads exceeding a reasonable length or containing unusual character-class repetition.

Monitoring Recommendations

Alert on abnormal CPU saturation of Puma, Unicorn, or Sidekiq workers combined with a drop in requests-per-second throughput.
Track application performance monitoring traces for Nokogiri::CSS::Parser and Nokogiri::CSS::Tokenizer frames with elevated latency.
Correlate slow-request logs with client source IPs to identify repeat abusers submitting adversarial selectors.

How to Mitigate CVE-2026-79770

Immediate Actions Required

Upgrade Nokogiri to version 1.19.3 or later across all Ruby applications and CI/CD pipelines.
Rebuild and redeploy container images, then invalidate cached gem dependencies to ensure the patched version is loaded.
Audit application code for locations where untrusted input reaches Node#css, Node#at_css, or Searchable#search, and restrict or validate that input.

Patch Information

The maintainers fixed the vulnerability in Nokogiri 1.19.3 by rewriting the affected regular expressions in the CSS selector tokenizer to eliminate ambiguous backtracking paths. Full details are available in the GitHub Security Advisory GHSA-c4rq-3m3g-8wgx. Update the gem in your Gemfile and run bundle update nokogiri.

Workarounds

Enforce a strict maximum length on any user-supplied CSS selector before passing it to Nokogiri, for example 128 characters.
Reject selectors that fail an allowlist regex covering standard CSS grammar rather than passing raw input directly to the tokenizer.
Wrap Nokogiri selector evaluations in a per-request timeout using Timeout.timeout or a supervisor to bound worker impact.

bash

# Configuration example
# Upgrade Nokogiri to the patched version
bundle update nokogiri

# Verify the installed version
bundle exec ruby -rnokogiri -e 'puts Nokogiri::VERSION'
# Expected output: 1.19.3 or later