CVE-2026-127056: PapaParse before 5.7.1 Quadratic-Time Parsing DoS via indexOf Scan
PapaParse before 5.7.1 contains an inefficient algorithmic complexity vulnerability that allows remote unauthenticated attackers to cause denial of service by submitting delimiter-free quoted CSV input to Papa.parse(). Attackers can supply a single-column quoted CSV with no delimiters, triggering repeated full-buffer indexOf scans per row that grow quadratically with input size, exhausting CPU and blocking the Node.js event loop or freezing a browser tab.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using PapaParse before 5.7.1 are exposed when they pass attacker-controlled CSV content to Papa.parse(). Both Node.js services and browser-based applications can be affected.
What input is required to trigger the denial of service?
An unauthenticated remote attacker must be able to submit CSV input for parsing. The triggering input is a delimiter-free, quoted, single-column CSV designed to cause repeated full-buffer indexOf scans.
What is the operational impact of successful exploitation?
Processing time grows quadratically with input size, allowing the input to exhaust CPU resources. In Node.js this can block the event loop, while in browsers it can freeze the tab.
How can I determine whether an application is affected?
Check whether the application uses PapaParse before version 5.7.1 and whether untrusted CSV data can reach Papa.parse(). Testing should use the affected parser with delimiter-free quoted single-column input in a controlled environment.