PAPAPARSE · CVE-2026-127056 · Package
NO FIX YET · SEE WHAT TO DO
PapaParse before 5.7.1 parses delimiter-free quoted CSV input with repeated full-buffer scans that grow quadratically with input size. An unauthenticated attacker can exhaust CPU, blocking the Node.js event loop or freezing a browser tab.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that pass untrusted CSV text to Papa.parse() in Node.js servers or in browsers, where an outside user can submit the input. Applications that only parse trusted, internal files are less exposed. unknown for other configurations.
Not affected if papaparse-5.7.1-or-later, trusted-input-only
Who cares browser, node.js, papaparse
papaparse package in package.json and lockfiles, and check the installed version with npm ls papaparse.Papa.parse() on input an outside party can supply, such as uploads or API request bodies.papaparse 5.7.1 or later (the fix is in the 5.7.1 release; the sources do not list other branches).PapaParse before 5.7.1 contains an inefficient algorithmic complexity vulnerability that allows remote unauthenticated attackers to cause denial of service by submitting delimiter-free quoted CSV input to Papa.parse(). Attackers can supply a single-column quoted CSV with no delimiters, triggering repeated full-buffer indexOf scans per row that grow quadratically with input size, exhausting CPU and blocking the Node.js event loop or freezing a browser tab.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.