{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/papaparse--5.7.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:papaparse:papaparse:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-127056"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PapaParse (\u003c 5.7.1)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003ePapaParse versions before 5.7.1 contain an inefficient algorithmic complexity vulnerability (CVE-2026-127056). Remote unauthenticated attackers can cause a denial of service by submitting specially crafted, delimiter-free quoted CSV input to the Papa.parse() function. This input triggers repeated full-buffer indexOf scans that grow quadratically with the input size, exhausting CPU resources and blocking the Node.js event loop or freezing browser tabs processing the data.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in service unavailability by freezing the application process or browser tab, as the CPU becomes dedicated to processing the malicious input. The CVSS 3.1 base score for this vulnerability is 7.5.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpgrade the PapaParse library to version 5.7.1 or later to implement the corrected parsing logic. Organizations should audit applications that accept user-provided CSV uploads to ensure they are using updated versions of the PapaParse dependency.\u003c/p\u003e\n","date_modified":"2026-11-12T14:15:53Z","date_published":"2026-11-12T14:15:53Z","id":"https://feed.craftedsignal.io/briefs/2026-11-papaparse-dos-cve-2026-127056/","summary":"PapaParse versions before 5.7.1 are susceptible to a denial of service vulnerability where maliciously crafted CSV input triggers quadratic CPU consumption, leading to resource exhaustion.","title":"PapaParse: Inefficient Algorithmic Complexity Denial of Service (CVE-2026-127056)","url":"https://feed.craftedsignal.io/briefs/2026-11-papaparse-dos-cve-2026-127056/"}],"language":"en","title":"CraftedSignal Threat Feed - PapaParse (\u003c 5.7.1)","version":"https://jsonfeed.org/version/1.1"}