{"id":"CVE-2026-127056","kind":"vulnerability","aliases":["CVE-2026-127056"],"related":[],"title":"PapaParse: crafted quoted CSV input causes quadratic CPU denial of service","description":"PapaParse before 5.7.1 contains an inefficient algorithmic complexity vulnerability that allows remote unauthenticated attackers to cause denial of service by submitting delimiter-free quoted CSV input to Papa.parse(). Attackers can supply a single-column quoted CSV with no delimiters, triggering repeated full-buffer indexOf scans per row that grow quadratically with input size, exhausting CPU and blocking the Node.js event loop or freezing a browser tab.","summary":"PapaParse before 5.7.1 parses delimiter-free quoted CSV input with repeated full-buffer scans that grow quadratically with input size. An unauthenticated attacker can exhaust CPU, blocking the Node.js event loop or freezing a browser tab.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"papaparse","fixed":[],"affected":"","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["browser","node.js","package","papaparse"],"not_affected_if":["papaparse-5.7.1-or-later","trusted-input-only"],"how_to_check":"- Look for the `papaparse` package in `package.json` and lockfiles, and check the installed version with `npm ls papaparse`.\n- Find code calling `Papa.parse()` on input an outside party can supply, such as uploads or API request bodies.","fix":"- `papaparse` 5.7.1 or later (the fix is in the 5.7.1 release; the sources do not list other branches).","status":"open","published_at":"2026-11-12T13:17:16+00:00","first_seen_at":"2026-11-12T13:38:24+00:00","triaged_at":"2026-11-12T13:38:42+00:00","updated_at":"2026-11-12T13:38:42+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-12T13:38:42Z","model":"claude-haiku-5-5","output":{"fix":"- `papaparse` 5.7.1 or later (the fix is in the 5.7.1 release; the sources do not list other branches).","reach":"internet","title":"PapaParse: crafted quoted CSV input causes quadratic CPU denial of service","impact":"medium","summary":"PapaParse before 5.7.1 parses delimiter-free quoted CSV input with repeated full-buffer scans that grow quadratically with input size. An unauthenticated attacker can exhaust CPU, blocking the Node.js event loop or freezing a browser tab.","audience":"developers","category":"package","nicknames":[],"who_cares":["node.js","browser","papaparse"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Server event loop or browser tab blocked by CPU exhaustion","analyst_note":"","how_to_check":"- Look for the `papaparse` package in `package.json` and lockfiles, and check the installed version with `npm ls papaparse`.\n- Find code calling `Papa.parse()` on input an outside party can supply, such as uploads or API request bodies.","plain_action":"","product_name":"papaparse","needs_analyst":false,"not_affected_if":["trusted-input-only","papaparse-5.7.1-or-later"],"who_is_affected":"Applications that pass untrusted CSV text to Papa.parse() in Node.js servers or in browsers, where an outside user can submit the input. Applications that only parse trusted, internal files are less exposed. unknown for other configurations.","user_interaction":"no","product_ecosystem":"npm","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000752,"input_tokens":4651,"output_tokens":574,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-127056':14A,17A '-2026':13A,16A '5.7.1':25B,63C 'algorithm':67C 'allow':71C 'attack':47B,74C,90C 'block':51B,120C 'browser':19B,59B,128C 'buffer':37B,106C 'caus':6A,76C 'column':96C 'complex':68C 'contain':64C 'cpu':8A,50B,118C 'craft':2A 'csv':4A,31B,86C,98C 'cve':12A,15A 'delimit':28B,83C,101C 'delimiter-fre':27B,82C 'denial':9A,77C 'event':54B,123C 'exhaust':49B,117C 'free':29B,84C 'freez':57B,126C 'full':36B,105C 'full-buff':35B,104C 'grow':40B,112C 'indexof':107C 'ineffici':66C 'input':5A,32B,43B,87C,115C 'loop':55B,124C 'node.js':20B,53B,122C 'packag':21B 'papa.parse':89C 'papapars':1A,22B,23B,61C 'papaparse':18A 'pars':26B 'per':109C 'quadrat':7A,41B,113C 'quot':3A,30B,85C,97C 'remot':72C 'repeat':34B,103C 'row':110C 'scan':38B,108C 'servic':11A,79C 'singl':95C 'single-column':94C 'size':44B,116C 'submit':81C 'suppli':92C 'tab':60B,129C 'trigger':102C 'unauthent':46B,73C 'vulner':69C","nicknames":[],"mitigations":[],"who_affected":"Applications that pass untrusted CSV text to Papa.parse() in Node.js servers or in browsers, where an outside user can submit the input. Applications that only parse trusted, internal files are less exposed. unknown for other configurations.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["papaparse"],"ptokens":["papaparse"],"labels":["browser","high","nodejs","npm","package","papaparse"],"campaign_type":null,"search_a":"'-127056':14A,17A '-2026':13A,16A 'caus':6A 'cpu':8A 'craft':2A 'csv':4A 'cve':12A,15A 'denial':9A 'input':5A 'papapars':1A 'papaparse':18A 'quadrat':7A 'quot':3A 'servic':11A","search_b":"'5.7.1':25B 'attack':47B 'block':51B 'browser':19B,59B 'buffer':37B 'cpu':50B 'csv':31B 'delimit':28B 'delimiter-fre':27B 'event':54B 'exhaust':49B 'free':29B 'freez':57B 'full':36B 'full-buff':35B 'grow':40B 'input':32B,43B 'loop':55B 'node.js':20B,53B 'packag':21B 'papapars':22B,23B 'pars':26B 'quadrat':41B 'quot':30B 'repeat':34B 'scan':38B 'size':44B 'tab':60B 'unauthent':46B","search_c":"'5.7.1':63C 'algorithm':67C 'allow':71C 'attack':74C,90C 'block':120C 'browser':128C 'buffer':106C 'caus':76C 'column':96C 'complex':68C 'contain':64C 'cpu':118C 'csv':86C,98C 'delimit':83C,101C 'delimiter-fre':82C 'denial':77C 'event':123C 'exhaust':117C 'free':84C 'freez':126C 'full':105C 'full-buff':104C 'grow':112C 'indexof':107C 'ineffici':66C 'input':87C,115C 'loop':124C 'node.js':122C 'papa.parse':89C 'papapars':61C 'per':109C 'quadrat':113C 'quot':85C,97C 'remot':72C 'repeat':103C 'row':110C 'scan':108C 'servic':79C 'singl':95C 'single-column':94C 'size':116C 'submit':81C 'suppli':92C 'tab':129C 'trigger':102C 'unauthent':73C 'vulner':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T13:17:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127056","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127056","severity":null,"published_at":"2026-11-12T13:17:16+00:00","modified_at":"2026-11-12T13:17:16+00:00","first_seen_at":"2026-11-12T13:38:24+00:00","fetched_at":"2026-11-12T13:38:24+00:00","note":null}],"documents":[{"id":135106,"url":"https://github.com/mholt/PapaParse/commit/a50fe19aae08b966de444119333fe4a8b7aa6b2f","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":135107,"url":"https://www.vulncheck.com/advisories/papaparse-before-quadratic-time-parsing-dos-via-indexof-scan","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}