---
id: "CVE-2026-115319"
kind: "vulnerability"
aliases: ["CVE-2026-115319"]
title: "fzf: quadratic string concatenation lets local requests stall its listen server"
severity: "low"
cvss: 2.5
epss: 0.00101
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["developer-tools", "fzf", "package", "shell"]
not_affected_if: ["default-config", "no-listen-flag"]
published_at: "2026-10-22T11:17:50+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:49:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115319", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115319", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# fzf: quadratic string concatenation lets local requests stall its listen server

fzf 0.36.0 through 0.74.5 builds a string quadratically in maskActionContents, so a POST body of about 1 MB blocks its single-threaded --listen HTTP server for roughly 30 seconds. An attacker on the same machine who can reach the unauthenticated localhost port can repeat the requests to keep the server unresponsive.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `fzf --version` and check whether it falls between `0.36.0` and `0.74.5`
- Check whether any script or process starts fzf with `--listen`

## Fix

- Upgrade fzf to a version later than `0.74.5`, if the sources name one; otherwise unknown
- Stop using `--listen` until upgraded

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115319
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115319

## From the sources

fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows local attackers to exhaust the --listen HTTP server through quadratic string concatenation. Attackers can repeatedly send POST bodies of about 1 MB to the unauthenticated localhost port, blocking the single-threaded server for about 30 seconds each time.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_