CVE-2026-79770
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Node#css, Node#at_css, and Searchable#search to cause exponential regex backtracking and denial of service.
Risk Assessment
The risk includes the possibility of application unavailability due to CPU exhaustion caused by malicious CSS selectors.
Recommendation
It is recommended to upgrade to version 1.19.3 or later and validate input used in CSS selectors.
Other vulnerabilities in Nokogiri
See all- GHSA-5prr-v3j2-97mhMedium
A vulnerability in the Nokogiri library affects the `Nokogiri::XML::NodeSet#[]` method (and its alias `#slice`). The index check against the node set's bounds used a 32-bit-truncated copy of the index, allowing a large negative index to pass the check and then be used at full width, reading outside the node set's storage.
- GHSA-5v8h-3h3q-446pLow
A vulnerability in the Nokogiri library allows calling `Document#encoding=` with an invalid encoding (e.g., a non-string or a string containing a null byte), which frees the document's current encoding string without replacing it. The document is left referencing freed memory, leading to a use-after-free condition on the next call.
- GHSA-8678-w3jw-xfc2Low
The vulnerability in the Nokogiri library for JRuby causes the NONET option to be incorrectly enforced when parsing XML schemas. This allows an attacker to load external network resources, potentially leading to data leakage or SSRF attacks.
- GHSA-9cv2-cfxc-v4v2Low
Nokogiri has a bug in methods called on allocated-but-uninitialized native wrapper classes inheriting from `Nokogiri::XML::Node`. This causes a NULL pointer dereference that could crash the process.
- GHSA-p67v-3w7g-wjg7Low
The vulnerability in the Nokogiri library causes `Nokogiri::XML::XPathContext` to not keep its source document alive for garbage collection. If an XPathContext outlives its document and the document is collected, evaluating an XPath expression could read invalid memory and potentially segfault.
- GHSA-phwj-rprq-35ppLow
Nokogiri's CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node, `Nokogiri::XML::Attr#value=` could free the underlying native child node while the wrapper remains.
- GHSA-wjv4-x9w8-wm3hLow
A vulnerability in the Nokogiri library allows a DTD node to be set as the document root, leading to a heap use-after-free during garbage collection or finalization. This results in an invalid memory read or potentially a segfault.
- GHSA-wfpw-mmfh-qq69Low
The vulnerability in the Nokogiri library affects the `Nokogiri::XML::Node#do_xinclude` method, which during XInclude processing removes `<xi:include>` nodes along with their children (e.g., `<xi:fallback>`) and declared namespaces. If an application previously accessed these nodes, unexpected behavior may occur.
- GHSA-g9g8-vgvw-g3vfUnknown
The vulnerability in the Nokogiri library affects the protected copy helper used by Node#dup and #clone methods. It unwrapped the source argument as an xmlNode without a type check, causing an out-of-bounds read on xmlNs structure and process crash when a non-Node object (e.g. Namespace) was supplied. Version 1.19.4 adds a type check and raises TypeError.
- CVE-2025-71407Critical
Nokogiri before 1.18.3 contains a stack buffer overflow vulnerability in libxml2 when reporting DTD validation errors with long QName prefixes, and a use-after-free vulnerability during validation against untrusted XML Schemas. Attackers can trigger these vulnerabilities by providing malicious DTD content or untrusted XSD files to cause denial of service or potential code execution.
Original NVD description (English source)
Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Node#css, Node#at_css, and Searchable#search to cause exponential regex backtracking and denial of service.