GHSA-2m3w-6mh6-8j3wHighCVSS 7.5
PapaParse before 5.7.1 contains an inefficient algorithmic complexity vulnerability that allows...
🔗 CVE IDs covered (1)
📋 Description
PapaParse before 5.7.1 contains an inefficient algorithmic complexity vulnerability that allows remote unauthenticated attackers to cause denial of service by submitting delimiter-free quoted CSV input to Papa.parse(). Attackers can supply a single-column quoted CSV with no delimiters, triggering repeated full-buffer indexOf scans per row that grow quadratically with input size, exhausting CPU and blocking the Node.js event loop or freezing a browser tab.
🔗 References (5)
- https://nvd.nist.gov/vuln/detail/CVE-2026-127056
- https://github.com/mholt/PapaParse/commit/a50fe19aae08b966de444119333fe4a8b7aa6b2f
- https://www.npmjs.com/package/papaparse
- https://www.vulncheck.com/advisories/papaparse-before-quadratic-time-parsing-dos-via-indexof-scan
- https://github.com/advisories/GHSA-2m3w-6mh6-8j3w