Cpe:2.3:a:papaparse:papaparse:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3apapaparsepapaparse/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 14:15:53 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPapaParse: Inefficient Algorithmic Complexity Denial of Service (CVE-2026-127056)https://feed.craftedsignal.io/briefs/2026-11-papaparse-dos-cve-2026-127056/Thu, 12 Nov 2026 14:15:53 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-papaparse-dos-cve-2026-127056/PapaParse versions before 5.7.1 are susceptible to a denial of service vulnerability where maliciously crafted CSV input triggers quadratic CPU consumption, leading to resource exhaustion.PapaParse versions before 5.7.1 contain an inefficient algorithmic complexity vulnerability (CVE-2026-127056). Remote unauthenticated attackers can cause a denial of service by submitting specially crafted, delimiter-free quoted CSV input to the Papa.parse() function. This input triggers repeated full-buffer indexOf scans that grow quadratically with the input size, exhausting CPU resources and blocking the Node.js event loop or freezing browser tabs processing the data.

Impact

Successful exploitation results in service unavailability by freezing the application process or browser tab, as the CPU becomes dedicated to processing the malicious input. The CVSS 3.1 base score for this vulnerability is 7.5.

Recommendation

Upgrade the PapaParse library to version 5.7.1 or later to implement the corrected parsing logic. Organizations should audit applications that accept user-provided CSV uploads to ensure they are using updated versions of the PapaParse dependency.

]]>lowadvisory