Security Resilience

CVE-2026-79770

Nokogiri ≤ 1.19.3

Public PoC
Published
25 August 2026
Modified
01 September 2026
Patch / advisory
View advisory
CVSS Score v4 8.7
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0049 41th percentile
Risk Priority 45 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-79770 is a high-severity Inefficient Regular Expression Complexity (CWE-1333) vulnerability in Nokogiri Nokogiri. Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 41th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Node#css, Node#at_css, and Searchable#search to cause exponential regex backtracking and…

more

denial of service.

CWE(s)
CWE-1333

Related Threats

MITRE ATT&CK Enterprise Techniques

T1499 Endpoint Denial of Service Impact
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.
attack.mitre.org →
T1499.003 Application Exhaustion Flood Impact
Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-57234Same product: Nokogiri Nokogiri
CVE-2026-57235Same product: Nokogiri Nokogiri
CVE-2026-57435Same product: Nokogiri Nokogiri
CVE-2026-57437Same product: Nokogiri Nokogiri
CVE-2026-57236Same product: Nokogiri Nokogiri
CVE-2026-57436Same product: Nokogiri Nokogiri
CVE-2026-57434Same product: Nokogiri Nokogiri
CVE-2026-25547Shared CWE-1333
CVE-2024-28864Shared CWE-1333
CVE-2026-45305Shared CWE-1333

Affected Assets

nokogiri
nokogiri
≤ 1.19.3

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SA-11 Developer Testing and Evaluation good match

Developer testing and evaluation can discover inefficient regex patterns via performance or static analysis.

SA-15 Development Process, Standards, and Tools partial match

Development standards and tools can require safe regex construction and forbid known exponential patterns.

SC-5 Denial-of-service Protection partial match

Denial-of-service protections limit resource exhaustion caused by expensive regex evaluation.

SI-10 Information Input Validation partial match

Input validation can constrain data that would otherwise trigger worst-case regex complexity.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
blocks

Secure SDLC practices directly prevent inefficient regex via reviews, static analysis, and safe libraries.

ID.RA-01 partial match
blocks

Vulnerability identification processes can discover ReDoS issues in existing code but do not stop their introduction.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect and reject regex patterns with exponential worst-case complexity.

A.8.28 Secure coding partial match
prevents

Secure coding standards explicitly prohibit or limit the use of inefficient regular expressions.

References