Nokogiri versions prior to 1.19.3 are vulnerable to Regular Expression Denial of Service (ReDoS) in the CSS selector tokenizer. The vulnerability affects string-literal and identifier tokenization within the library. Attackers can exploit this by injecting adversarial CSS selectors into methods such as Node#css, Node#at_css, and Searchable#search. This causes exponential regex backtracking, leading to denial of service conditions. The vulnerability is tracked as CVE-2026-79770 and has been patched in Nokogiri 1.19.3. Users of affected versions should upgrade immediately to mitigate the risk. The issue is documented across NVD, GitHub Security Advisories, and VulnCheck.