Nokogiri versions prior to 1.19.3 contain a regular expression denial of service vulnerability in the CSS selector tokenizer. The flaw lies in the string‑literal and identifier tokenization logic. When an attacker supplies crafted CSS selectors to methods such as Node#css, Node#at_css, or Searchable#search, the underlying regex engine can experience exponential backtracking, exhausting CPU or memory resources and causing a denial of service for the affected process. The vulnerability does not provide remote code execution or direct data exfiltration; its primary impact is availability disruption.

The issue affects the Nokogiri library developed by sparklemotion. All installations of Nokogiri earlier than version 1.19.3 are vulnerable, regardless of host platform. Any Ruby application that uses Nokogiri to parse user‑supplied or untrusted CSS will be at risk. Updating to Nokogiri 1.19.3 or later removes the vulnerable tokenizer implementation.

The CVSS score of 8.7 reflects a high severity that can be exploited by remote or local attackers who can supply malicious CSS selectors to the vulnerable methods. The EPSS score is unavailable, and the vulnerability is not listed in CISA KEV, indicating no known widespread exploitation at this time. However, the nature of the flaw allows an attacker to trigger a denial of service through crafted input, and any application that accepts untrusted CSS without sanitization is a candidate for exploitation. The most likely attack vector is the inclusion of adversarial selectors in requests that reach Nokogiri’s CSS parsing APIs.