CVE-2026-79770CWE-1333

CVE-2026-79770

High · published August 25, 2026

CVSS v3.1

7.5

EPSS

Percentile

41.4

In the wild

Unconfirmed

What it is

Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Node#css, Node#at_css, and Searchable#search to cause exponential regex backtracking and denial of service.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00493 · 41.4th percentile
Weakness: CWE-1333 · Inefficient Regular Expression Complexity
Published: 2026-08-25T20:17Z

Affected products (1)

Product	Versions	Fixed in
nokogiri/nokogiri	< 1.19.3	1.19.3

References (2)

https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-c4rq-3m3g-8wgx · [email protected]https://www.vulncheck.com/advisories/nokogiri-before-redos-via-css-selector-tokenizer · [email protected]

EPSS history

Timeline

27 AUG 06:46Z
EPSS moved — → 0%
epss
25 AUG 15:16Z
Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer
cvelistv5