High severity7.5NVD Advisory· Published Aug 25, 2026· Updated Sep 1, 2026
CVE-2026-79770
CVE-2026-79770
Description
Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Node#css, Node#at_css, and Searchable#search to cause exponential regex backtracking and denial of service.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
nokogiriRubyGems | < 1.19.3 | 1.19.3 |
Affected products
26- osv-coords25 versionspkg:apk/chainguard/gitlab-rails-ce-18.11pkg:apk/chainguard/gitlab-rails-ce-19.0pkg:apk/chainguard/ruby3.2-rails-7.2pkg:apk/chainguard/ruby3.2-rails-8.1pkg:apk/chainguard/ruby4.0-rails-8.1pkg:apk/chainguard/ruby3.3-rails-8.0pkg:apk/chainguard/ruby4.0-rails-8.0pkg:apk/chainguard/gitlab-rails-ce-18.10pkg:apk/chainguard/gitlab-rails-ce-fips-18.10pkg:apk/wolfi/ruby4.0-rails-8.1pkg:apk/chainguard/ruby3.4-kube-logging-operator-fluentd-outputspkg:apk/chainguard/ruby3.2-kube-logging-operator-fluentd-outputspkg:apk/chainguard/ruby3.2-rails-8.0pkg:apk/chainguard/ruby3.3-rails-7.2pkg:apk/chainguard/ruby3.4-rails-7.2pkg:apk/chainguard/ruby3.4-rails-8.0pkg:apk/chainguard/ruby3.4-rails-8.1pkg:apk/chainguard/ruby4.0-rails-7.2pkg:apk/wolfi/ruby3.2-rails-8.1pkg:apk/wolfi/ruby3.4-rails-8.1pkg:apk/chainguard/pact-broker-docker-fipspkg:apk/chainguard/pact-broker-dockerpkg:apk/wolfi/ruby3.2-kube-logging-operator-fluentd-outputspkg:apk/wolfi/ruby3.4-kube-logging-operator-fluentd-outputspkg:apk/chainguard/gitlab-rails-ce-fips-18.11
< 18.11.5-r0+ 24 more
- (no CPE)range: < 18.11.5-r0
- (no CPE)range: < 19.0.2-r0
- (no CPE)range: < 7.2.3.1-r2
- (no CPE)range: < 8.1.3-r3
- (no CPE)range: < 8.1.3-r4
- (no CPE)range: < 8.0.5-r2
- (no CPE)range: < 8.0.5-r2
- (no CPE)range: < 18.10.8-r0
- (no CPE)range: < 18.10.8-r0
- (no CPE)range: < 8.1.3-r4
- (no CPE)range: < 6.5.0-r2
- (no CPE)range: < 6.5.0-r2
- (no CPE)range: < 8.0.5-r1
- (no CPE)range: < 7.2.3.1-r3
- (no CPE)range: < 7.2.3.1-r3
- (no CPE)range: < 8.0.5-r2
- (no CPE)range: < 8.1.3-r3
- (no CPE)range: < 7.2.3.1-r3
- (no CPE)range: < 8.1.3-r3
- (no CPE)range: < 8.1.3-r3
- (no CPE)range: < 2.138.0.2.119.0-r1
- (no CPE)range: < 2.138.0.2.119.0-r1
- (no CPE)range: < 6.5.0-r2
- (no CPE)range: < 6.5.0-r2
- (no CPE)range: < 18.11.5-r0
- Range: <1.19.3
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-c4rq-3m3g-8wgxghsaADVISORY
- github.com/sparklemotion/nokogiri/security/advisories/GHSA-c4rq-3m3g-8wgxnvdMitigationVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-79770ghsaADVISORY
- www.vulncheck.com/advisories/nokogiri-before-redos-via-css-selector-tokenizernvdThird Party AdvisoryWEB
News mentions
0No linked articles in our index yet.