High priorityDisclosed

Advisory · CVE-2026-127056

PapaParse quadratic-time parsing flaw allows unauthenticated denial of service

PapaParse before 5.7.1 lets a remote unauthenticated attacker exhaust CPU by submitting delimiter-free quoted CSV input, blocking the Node.js event loop or freezing a browser tab. NVD rates it high at CVSS 4.0 8.7.

Advisory published November 12, 2026Independent summary
Vendor
PapaParse
Product
PapaParse
Identifier / CWE
CVE-2026-127056
CWE-407
Action timing
Immediate
ELI5

Explain it like I’m five

PapaParse reads a spreadsheet one row at a time, but a sneaky input makes it re-read the whole page for every row. A small file can keep it busy forever, so the app stops answering anyone else.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Crafted CSV submitted

    A remote unauthenticated attacker submits a single-column quoted CSV with no delimiters to an application that parses it with Papa.parse().

  2. 02Repeated full scans

    The parser performs repeated full-buffer indexOf scans per row, and the work grows quadratically with input size.

  3. 03CPU exhausted

    The parsing loop consumes the CPU, blocking the Node.js event loop or freezing a browser tab.

  4. 04Service unavailable

    Legitimate requests stall or the interface stops responding while the parse runs.

What happened

PapaParse releases before 5.7.1 contain an inefficient algorithmic complexity vulnerability (CWE-407). NVD describes it as allowing remote unauthenticated attackers to cause denial of service by submitting delimiter-free quoted CSV input to Papa.parse(): a single-column quoted CSV with no delimiters triggers repeated full-buffer indexOf scans per row that grow quadratically with input size, exhausting CPU and blocking the Node.js event loop or freezing a browser tab. NVD rates it high at CVSS 4.0 8.7 (CVSS 3.1 7.5).

PapaParse is one of the most widely used CSV parsers in the JavaScript ecosystem, so the exposure is anywhere an application parses CSV supplied by an untrusted party: file uploads, pasted data, imports, and browser-side parsing included. The flaw needs no authentication and no large file, just a small input shaped to hit the quadratic path.

What to do

  1. Inventory applications and services that depend on papaparse and confirm the installed version.
  2. Upgrade affected deployments (before 5.7.1) to PapaParse 5.7.1 or later.
  3. Until patched, limit CSV input size and reject or quarantine delimiter-free quoted input at the edge where feasible.
  4. Review application logs and performance metrics for slow parse operations, CPU spikes, and stalled event loops tied to CSV handling.
  5. Verify the deployed version after remediation.

Management note

A denial-of-service flaw in a parsing library is easy to dismiss until the one public upload form that accepts CSV takes the service down. Upgrade the library, then put a size and shape limit on untrusted CSV input as a standing control.