Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-127056— PapaParse before 5.7.1 Quadratic-Time Parsing DoS via indexOf Scan

Quick assessment

Affected
mholt PapaParse
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

PapaParse 5.7.1 之前的版本存在算法复杂度低效的漏洞。远程未认证攻击者可通过向 提交不含分隔符的带引号 CSV 输入，引发拒绝服务（DoS）攻击。攻击者可构造单列、带引号且无分隔符的 CSV 数据，触发每行对完整缓冲区执行重复的 扫描；该操作的时间复杂度随输入规模呈二次方增长，从而导致 CPU 资源耗尽，阻塞 Node.js 事件循环或使浏览器标签页冻结。

CVSS 7.5 · High

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-127056

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
PapaParse before 5.7.1 Quadratic-Time Parsing DoS via indexOf Scan
Source: CVE Program / CVE List V5
Vulnerability Description
PapaParse before 5.7.1 contains an inefficient algorithmic complexity vulnerability that allows remote unauthenticated attackers to cause denial of service by submitting delimiter-free quoted CSV input to Papa.parse(). Attackers can supply a single-column quoted CSV with no delimiters, triggering repeated full-buffer indexOf scans per row that grow quadratically with input size, exhausting CPU and blocking the Node.js event loop or freezing a browser tab.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
算法复杂性
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
mholt PapaParse 0 ~ 5.7.1 -

II. Public POCs for CVE-2026-127056

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-127056

请登录查看更多情报信息。

Other References for CVE-2026-127056 (3)

IV. Related Vulnerabilities

Same product: PapaParse
Same vendor: mholt
Same weakness: CWE-407