CVE-2026-79770 sparklemotion CVE debrief

Who should care

Developers and administrators using Nokogiri versions before 1.19.3 should be aware of the potential denial of service vulnerabilities and take immediate action to update or mitigate the risk. This includes reviewing and restricting the use of untrusted or user-supplied CSS selectors, implementing input validation and sanitization, and monitoring for potential attacks.

Technical summary

Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer, affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into Nokogiri methods like Node#css, Node#at_css, and Searchable#search to cause exponential regex backtracking and denial of service. The vulnerability is particularly concerning due to its high CVSS score of 8.7, indicating a significant risk of denial of service attacks through regular expression denial of service vulnerabilities in Nokogiri versions before 1.19.3. It is essential for developers and administrators to review and restrict the use of untrusted or user-supplied CSS selectors, implement input validation and sanitization, and monitor for potential attacks.

Defensive priority

High-priority defensive actions are required due to the HIGH CVSS score of 8.7 for CVE-2026-79770, indicating a significant risk of denial of service attacks through regular expression denial of service vulnerabilities in Nokogiri versions before 1.19.3.

Recommended defensive actions

• Update Nokogiri to version 1.19.3 or later to mitigate the regular expression denial of service vulnerabilities.
• Implement input validation and sanitization for CSS selectors to prevent adversarial input.
• Monitor for and restrict the use of untrusted or user-supplied CSS selectors in Nokogiri methods like Node#css, Node#at_css, and Searchable#search.
• Consider applying compensating controls, such as Web Application Firewalls (WAFs), to detect and prevent potential attacks.
• Regularly review and update the Nokogiri library to ensure the latest security patches are applied.

Evidence notes

Evidence from official sources indicates that Nokogiri versions before 1.19.3 are vulnerable to regular expression denial of service attacks via CSS selector tokenizer. The CVE record and NVD detail page provide critical information on the vulnerability, including its CVSS score and affected versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.