CVE-2026-72912: CyberChef’s pretty-recipe parser vulnerable to client-side ReDoS / CPU exhaustion when parsing a malformed #recipe= URL
CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed #recipe= URL fragment containing a large number of unmatched quote characters reaches Utils.parseRecipeConfig(). The function synchronously applies a complex global regular expression that may perform heavy backtracking before rejecting the input, causing the victim's browser tab to freeze during startup for seconds or longer. No code execution, data exfiltration, or privilege escalation occurs. This issue is fixed in version 11.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CyberChef (pretty-recipe parser / Utils.parseRecipeConfig in src/core/Utils.mjs)to a version that resolves this vulnerability.Fixed in 11.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72912?
CVE-2026-72912 has a medium severity rating of 4.3.
How do I fix CVE-2026-72912?
To fix CVE-2026-72912, upgrade to CyberChef version 11.3.0 or later.
What type of vulnerability is CVE-2026-72912?
CVE-2026-72912 is a client-side ReDoS vulnerability that can cause CPU exhaustion.
What impact does CVE-2026-72912 have on CyberChef users?
CVE-2026-72912 can lead to performance issues on clients' machines when parsing malformed #recipe= URLs.
Is CVE-2026-72912 related to any specific component of CyberChef?
CVE-2026-72912 affects the pretty-recipe parser component in the CyberChef application.