{"action":"Upgrade nokogiri to 1.19.3 or later.","affected":[{"fixed":"1.19.3","introduced":"0"}],"component":"nokogiri","cve_ids":["CVE-2026-79770"],"ecosystem":"RubyGems","epss":0.00493,"exploited":false,"fixed_versions":["1.19.3"],"ghsa_id":"GHSA-c4rq-3m3g-8wgx","id":"tcs_01M5KEJMJYCP4JGXKRXVBXQ7YJ","modified_at":"2026-09-10T03:50:46.628632949Z","published_at":"2026-05-06T18:24:18Z","references":["https://osv.dev/vulnerability/GHSA-c4rq-3m3g-8wgx","https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-c4rq-3m3g-8wgx","https://nvd.nist.gov/vuln/detail/CVE-2026-79770","https://github.com/sparklemotion/nokogiri","https://www.vulncheck.com/advisories/nokogiri-before-redos-via-css-selector-tokenizer"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-c4rq-3m3g-8wgx","url":"https://osv.dev/vulnerability/GHSA-c4rq-3m3g-8wgx"}],"summary":"Nokogiri CSS selector tokenizer has regular expression backtracking"}