Nokogiri CVE-2026-79770

Exploitation requires that the target application passes attacker-controlled text directly into one of the affected CSS selector methods: Nokogiri::CSS.xpath_for, Node#css, Node#at_css, Searchable#search, or CSS::Parser#parse. Applications that construct all CSS selectors from developer-authored strings are not exploitable regardless of Nokogiri version. Three distinct input classes trigger the vulnerability: unterminated quoted strings in CSS string literals, hex-escape-rich strings in CSS string literals, and hex-escape-rich strings in CSS identifiers. Exploitation requires no authentication (CVSS PR:N) and no user interaction - any network-accessible endpoint that accepts user input funneled into a selector method is a valid attack surface. No non-default Nokogiri configuration is required; the vulnerable tokenizer is active in all default deployments.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H, score 8.7) indicates a network-exploitable, low-complexity, unauthenticated attack with high availability impact, consistent with the vendor's own CVSS 3.1 assessment of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - the difference reflects the CVSS 4.0 scoring scale rather than a substantive disagreement. No EPSS score was provided in the source intelligence and cannot be cited. This CVE does not appear in the CISA KEV catalog, and no public exploit code has been identified, so exploitation status is unconfirmed. Despite high CVSS scoring, real-world exploitability is gated on one significant condition: the application must pass attacker-controlled text into a Nokogiri CSS selector method - applications using only developer-authored selectors are not exposed, which substantially narrows the affected population. However, web scrapers, HTML sanitizers, and applications with user-facing search or filtering features commonly fall into the exposed category, and crafting a ReDoS payload for known backtracking patterns requires minimal technical skill once the vulnerability class is understood, so exposed surfaces should be patched without delay. There is no confidentiality or integrity impact; this is a pure availability threat.

An attacker submits a crafted CSS selector - such as a deeply hex-escaped identifier or an unterminated quoted string - through an application feature that passes user input to a Nokogiri CSS selector method such as Node#css. The Ruby regex engine enters exponential backtracking, consuming 100% CPU for an extended period or until a process-level timeout, denying service to concurrent users. No public exploit code has been identified at time of analysis, but constructing a ReDoS payload for known backtracking patterns is a well-documented technique requiring no specialized tooling.