CVE-2026-79770: Nokogiri

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Node#css, Node#at_css, and Searchable#search to cause exponential regex backtracking and denial of service.

Affected products

• Nokogiri Nokogiri: before 1.19.3 (fixed in 1.19.3)

Published 2026-08-25. Last modified 2026-09-01.