Exponential Regex Backtracking in Nokogiri CSS Selector Tokenizer - High Severity Vulnerability
Summary
GHSA-c4rq-3m3g-8wgx: Nokogiri CSS selector tokenizer has regular expression backtracking. Affects nokogiri versions < 1.19.3. Fixed in 1.19.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Nokogiri is a popular Ruby library used for parsing HTML and XML documents. It provides a powerful CSS selector engine that allows developers to query and manipulate document structures easily. However, the library's CSS selector tokenizer has been found to be vulnerable to regular expression backtracking, which can lead to performance issues and denial of service under certain conditions.
Vulnerability Detail
The vulnerability arises from the construction of regular expressions in Nokogiri's CSS selector tokenizer, which can result in exponential backtracking when processing adversarial selectors. This can be triggered by specific patterns in user-supplied input, leading to significant performance degradation. The affected methods include Nokogiri::CSS.xpath_for, Node#css, Node#at_css, Searchable#search, and CSS::Parser#parse. If exploited, an attacker can cause a denial of service by injecting malicious input into these methods.
How To Fix
Latest published version: 1.19.4 as of 22 Oct 2026
gem install nokogiri -v 1.19.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.19.3
This is the first release that contains the fix.
gem install nokogiri -v 1.19.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not feasible, consider the following workarounds: 1. Avoid using attacker-controlled text in CSS selectors. Ensure that only developer-authored selectors are passed to Nokogiri. 2. Set a global timeout for regular expressions in Ruby 3.2+ or JRuby 9.4+ by adding the following line to your code: 'Regexp.timeout = 1' (where '1' is the timeout in seconds).
Conclusion
The Nokogiri CSS selector tokenizer vulnerability poses a significant risk due to its potential for causing denial of service through exponential regex backtracking. It is crucial for developers to upgrade to the patched version or implement workarounds to safeguard their applications.
See every vulnerability recorded for nokogiri →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
All versions of Nokogiri prior to 1.19.3 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to denial of service, causing your application to become unresponsive due to excessive resource consumption.
Yes, you can mitigate the risk by avoiding user-controlled input in CSS selectors and setting a timeout for regular expressions.
References
Related vulnerabilities
Recent vulnerabilities recorded for nokogiri.
