PapaParse: Inefficient Algorithmic Complexity Denial of Service (CVE-2026-127056)

PapaParse versions before 5.7.1 contain an inefficient algorithmic complexity vulnerability (CVE-2026-127056). Remote unauthenticated attackers can cause a denial of service by submitting specially crafted, delimiter-free quoted CSV input to the Papa.parse() function. This input triggers repeated full-buffer indexOf scans that grow quadratically with the input size, exhausting CPU resources and blocking the Node.js event loop or freezing browser tabs processing the data.

Impact

Successful exploitation results in service unavailability by freezing the application process or browser tab, as the CPU becomes dedicated to processing the malicious input. The CVSS 3.1 base score for this vulnerability is 7.5.

Recommendation

Upgrade the PapaParse library to version 5.7.1 or later to implement the corrected parsing logic. Organizations should audit applications that accept user-provided CSV uploads to ensure they are using updated versions of the PapaParse dependency.